---
id: "CVE-2026-63478"
kind: "vulnerability"
aliases: ["CVE-2026-63478"]
title: "isomorphic-git: crafted tree entries let a clone write files outside the project"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["browser", "git", "isomorphic-git", "node.js", "package"]
not_affected_if: ["github-only-remotes", "not-using-isomorphic-git"]
published_at: "2026-11-03T20:18:16+00:00"
first_seen_at: "2026-11-03T20:49:23+00:00"
updated_at: "2026-11-03T20:51:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63478", "first_seen_at": "2026-11-03T20:49:23+00:00"}]
---

# isomorphic-git: crafted tree entries let a clone write files outside the project

isomorphic-git, a pure JavaScript Git library for Node.js and browsers, accepts a tree entry named '..' during clone or checkout from a non-GitHub remote. An attacker-controlled or man-in-the-middle remote can then write files to attacker-chosen paths, which can overwrite startup or configuration files and lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls isomorphic-git` in each project that depends on it.
- Look for code that clones or checks out repositories from remotes you do not control, since GitHub-hosted trees are not a direct source.

## Fix

- isomorphic-git: upgrade to `1.38.6` or later.

## Timeline

- 2026-11-03T20:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63478

## Documents

- [advisory] Vendor advisory: github.com https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6
- [fix] Patch: github.com https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b
- [fix] Release notes: github.com https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6

## From the sources

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_