Read the docs
TI-2026-60327 Aliases CVE-2026-89011

isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

Priority LOW 38CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed isomorphic-git (isomorphic-git): 1.42.0Red Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
isomorphic-gitisomorphic-gitbefore 1.42.01.42.0Patch availableCNA
  • isomorphic-git Vendorisomorphic-git Affected before 1.42.0 Fixed in 1.42.0 Patch available CNA

Remediation

  • Fix · CNA isomorphic-git (isomorphic-git) Fixed in 1.42.0

Red Hat 5 advisories

  • RHSA-2026:88200 Released 2026-10-22 · Red Hat rating Critical
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:79088 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:76788 Released 2026-10-06 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
Show 2 more Red Hat advisories
  • RHSA-2026:72722 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:72712 Released 2026-09-28 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:72712
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:72722, RHSA-2026:88200
Red Hat Developer Hub 1.10Fixed RHSA-2026:76788, RHSA-2026:79088
Not affected: 1 product
  • Red Hat Developer Hub 1.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89011
  2. 2026-10-07 Fix available: RHSA-2026:76788 · Red Hat
  3. 2026-10-07 Fix available: Red Hat Developer Hub 1.10 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
  5. 2026-10-09 Affected versions changed · Red Hat
  6. 2026-10-23 Fix available: RHSA-2026:88200 · Red Hat
  7. 2026-10-23 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

Other 1

  • TI-2026-84487 Path traversal in isomorphic-git checkout lets attackers write files CVSS 3.1HIGH 8.8
  • TI-2026-84492 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout CVSS 3.1MEDIUM 5.3
  • TI-2026-84491 Unbounded memory allocation in isomorphic-git delta handling CVSS 3.1MEDIUM 4.3
  • TI-2026-84490 Circular symbolic refs hang ref resolution in isomorphic-git CVSS 3.1MEDIUM 4.3
  • TI-2021-06178 Server-side request forgery (SSRF) in @isomorphic-git/cors-proxy CVSS 3.1HIGH 8.6
  • TI-2021-10885 isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences