Skip to content
OpenAdvisories

Vendor

isomorphic-git

5 known vulnerabilities.

isomorphic-git at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 4 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202640
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

isomorphic-git 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.8
    CVE-2026-63395

    isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first pl…

    isomorphic-git isomorphic-git
  • Medium 4.3
    CVE-2026-63475

    isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbol…

    isomorphic-git isomorphic-git
  • Medium 4.3
    CVE-2026-63476

    isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(t…

    isomorphic-git isomorphic-git
  • Medium 5.3
    CVE-2026-63478

    isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkou…

    isomorphic-git isomorphic-git
  • High 7.1
    CVE-2026-89011

    isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

    isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref ne…

    isomorphic-git isomorphic-git