isomorphic-git path traversal allows arbitrary file writes and denial of service

Git library for JavaScript apps; bad repos can overwrite your files.

Summary

isomorphic-git is a JavaScript implementation of Git. Cloning or checking out a malicious or intercepted non-GitHub repository can write files outside the working folder, or stall programs through huge memory allocation and endless loops.

Affected when

Cloning or checking out from a non-GitHub remote or a man-in-the-middle attack
Host file system writes (Node fs on Linux, macOS or Windows)

What to do

Update to isomorphic-git 1.38.6 or later. Until then, do not clone or check out untrusted repositories.

Products and platforms

isomorphic-git

CVE IDs

Sources

Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-03 19:39 UTC

First seen 2026-11-09 14:50 UTC