{"id":"CVE-2026-63478","kind":"vulnerability","aliases":["CVE-2026-63478"],"related":[],"title":"isomorphic-git: crafted tree entries let a clone write files outside the project","description":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.","summary":"isomorphic-git, a pure JavaScript Git library for Node.js and browsers, accepts a tree entry named '..' during clone or checkout from a non-GitHub remote. An attacker-controlled or man-in-the-middle remote can then write files to attacker-chosen paths, which can overwrite startup or configuration files and lead to code execution.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","git","isomorphic-git","node.js","package"],"not_affected_if":["github-only-remotes","not-using-isomorphic-git"],"how_to_check":"- Check the installed version with `npm ls isomorphic-git` in each project that depends on it.\n- Look for code that clones or checks out repositories from remotes you do not control, since GitHub-hosted trees are not a direct source.","fix":"- isomorphic-git: upgrade to `1.38.6` or later.","status":"open","published_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:51:53+00:00","updated_at":"2026-11-03T20:51:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:51:53Z","model":"claude-haiku-5-5","output":{"fix":"- isomorphic-git: upgrade to `1.38.6` or later.","reach":"network","title":"isomorphic-git: crafted tree entries let a clone write files outside the project","impact":"high","summary":"isomorphic-git, a pure JavaScript Git library for Node.js and browsers, accepts a tree entry named '..' during clone or checkout from a non-GitHub remote. An attacker-controlled or man-in-the-middle remote can then write files to attacker-chosen paths, which can overwrite startup or configuration files and lead to code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["isomorphic-git","node.js","browser","git"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker writes files to chosen paths, possibly running code.","analyst_note":"","how_to_check":"- Check the installed version with `npm ls isomorphic-git` in each project that depends on it.\n- Look for code that clones or checks out repositories from remotes you do not control, since GitHub-hosted trees are not a direct source.","plain_action":"","needs_analyst":false,"not_affected_if":["github-only-remotes","not-using-isomorphic-git"],"who_is_affected":"Projects that use isomorphic-git to clone or check out repositories from non-GitHub remotes, especially where the remote could be malicious or reached through a man-in-the-middle. GitHub-hosted trees are not a direct source because GitHub rejects '..' entries. Projects that do not use the library, or only work with GitHub-hosted repositories, are less exposed.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4307,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63478':17A,20A '1.38.6':103C,206C 'accept':40B,112C 'arbitrari':169C 'attack':57B,72B,157C 'attacker-chosen':71B 'attacker-control':56B 'attacker-select':156C 'back':165C 'browser':21B,39B,100C 'check':199C 'checkout':48B,128C 'chosen':73B 'clone':9A,46B,126C 'code':85B,181C 'configur':80B,176C 'control':58B,138C 'craft':4A 'cve':15A,18A 'direct':190C 'entri':6A,43B,117C,144C,195C 'escap':146C 'execut':86B,182C 'file':11A,69B,81B,154C,170C,177C 'fix':203C 'fs':166C 'git':3A,22B,25B,30B,34B,89C,96C,106C 'github':53B,141C,184C,193C 'github-host':183C 'host':164C,185C 'host-back':163C 'implement':94C 'integr':198C 'isomorph':2A,24B,29B,88C,105C 'isomorphic-git':1A,23B,28B,87C,104C 'issu':201C 'javascript':33B,93C 'lead':83B,179C 'let':7A 'librari':35B 'malici':131C 'man':61B,134C 'man-in-the-middl':60B 'man-in-the-middle-control':133C 'middl':64B,137C 'name':44B,118C 'nest':143C 'node.js':26B,37B,98C 'non':52B,140C 'non-github':51B,139C 'outsid':12A 'overwrit':77B,173C 'packag':27B 'parent':159C 'parser':109C 'path':74B,123C,160C 'prior':101C 'project':14A 'provid':167C 'pure':32B,92C 'reject':121C,194C 'remot':54B,65B,142C 'repositori':197C 'root':151C 'select':158C 'separ':124C 'sourc':191C 'src/models/gittree.js':111C 'standalon':114C 'startup':78B,174C 'tree':5A,42B,108C,116C,150C,186C 'tree-entri':115C 'version':205C 'work':149C 'working-tre':148C 'write':10A,68B,153C,171C","nicknames":[],"mitigations":[],"who_affected":"Projects that use isomorphic-git to clone or check out repositories from non-GitHub remotes, especially where the remote could be malicious or reached through a man-in-the-middle. GitHub-hosted trees are not a direct source because GitHub rejects '..' entries. Projects that do not use the library, or only work with GitHub-hosted repositories, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["browser","git","isomorphicgit","medium","nodejs","package"],"campaign_type":null,"first_public_at":"2026-07-01T11:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63478","severity":null,"published_at":"2026-11-03T20:18:16+00:00","modified_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null}],"documents":[{"id":60576,"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60577,"url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60606,"url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T11:16:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}