CVE-2026-63478mediumCWE-22

CVE-2026-63478: falha de média gravidade em isomorphic-git

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar isomorphic-git

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
isomorphic-git · isomorphic-git
CVEs relacionadas — isomorphic-git

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63395HIGHisomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)EPSS 0.7%CVE-2026-89011HIGHisomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfoEPSS 0.4%CVE-2026-63475MEDIUMisomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)EPSS 0.4%CVE-2026-63476MEDIUMisomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)EPSS 0.3%