Arbitrary File Write Vulnerability in isomorphic-git Product by isomorphic-git

CVE-2026-63478

What is CVE-2026-63478?

The isomorphic-git library, a pure JavaScript implementation of Git for both Node.js and browser environments, contains a vulnerability in its tree parser (src/models/GitTree.js) prior to version 1.38.6. This issue arises from the parser's acceptance of standalone '..' tree-entry names, which can be exploited under certain conditions. Specifically, during a clone or checkout from a compromised or non-secure remote source, adversaries can manipulate nested '..' entries. Such manipulation can potentially allow these entries to bypass the working tree's root, enabling attackers to write files at unauthorized parent paths. This arbitrary file write capability raises significant security concerns, as it can overwrite critical startup or configuration files, leading to possible code execution on affected systems. Users are advised to update to version 1.38.6 or later to mitigate these vulnerabilities.

References