Skip to content
OpenAdvisories

Vendor

isomorphic-git

5 known vulnerabilities.

Products

isomorphic-git 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-63395

    isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

    isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first pl…

    isomorphic-git isomorphic-git isomorphic-git npm
  • High 7.1
    CVE-2026-89011

    isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

    isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref ne…

    isomorphic-git isomorphic-git