Improper Handling of Symlinks in isomorphic-git for Node.js and Browsers

CVE-2026-63395

What is CVE-2026-63395?

The isomorphic-git library, a pure JavaScript implementation designed for Node.js and browser environments, is prone to an issue where it fails to properly validate symlinked directory components during the checkout process. This flaw allows a malicious repository to exploit the symlink handling by first establishing a directory symlink, which can be later manipulated to replace a subtree with a malicious file. The vulnerability may be triggered during a clone operation followed by a pull, but can also be activated through a single clone if a symlink is already present. On Linux and macOS, the issue may lead to unwanted writes outside the typical working tree, potentially resulting in unauthorized file modifications or even arbitrary code execution. On Windows, the Node file system usually restricts such symlink interactions unless elevated privileges are granted. Please ensure you are updated to version 1.38.6 or later to mitigate this risk.

References