Prototype Pollution Vulnerability in isomorphic-git by NodeGit

CVE-2026-89011

What is CVE-2026-89011?

The isomorphic-git library version prior to 1.42.0 is vulnerable to a prototype pollution flaw in the getRemoteInfo function. A malicious actor controlling a Git server can exploit this weakness by advertising crafted reference names that contain 'proto' path segments during the negotiation process. This manipulation allows the attacker to pollute the Object.prototype, enabling unauthorized redirection of network operations through an attacker-controlled proxy. Consequently, when users invoke getRemoteInfo with a specially supplied URL, their credentials may be exposed via the onAuth callback, putting sensitive data at risk.

References