Live › vulnerability › CVE-2026-63478
isomorphic-git, a pure JavaScript Git library for Node.js and browsers, accepts a tree entry named '..' during clone or checkout from a non-GitHub remote. An attacker-controlled or man-in-the-middle remote can then write files to attacker-chosen paths, which can overwrite startup or configuration files and lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Projects that use isomorphic-git to clone or check out repositories from non-GitHub remotes, especially where the remote could be malicious or reached through a man-in-the-middle. GitHub-hosted trees are not a direct source because GitHub rejects '..' entries. Projects that do not use the library, or only work with GitHub-hosted repositories, are less exposed.
No product ranges from the sources yet.
npm ls isomorphic-git in each project that depends on it.1.38.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-63478")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.