Path traversal in isomorphic-git checkout lets attackers write files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
isomorphic-git before 1.38.6 lets git.checkout write new paths through symlinked directory components without checking them (CWE-59). A malicious repository can plant a directory symlink and later place a file beneath it, usually during a clone followed by a pull, so the write lands outside the working tree. With Node fs on Linux or macOS, this permits arbitrary host file writes and possibly code execution. Windows usually blocks the symlink plant, and browser or in-memory providers are limited to their virtual filesystem.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| isomorphic-git | isomorphic-git | before 1.38.6 | 1.38.6 | Patch available | CNA |
- isomorphic-git Vendorisomorphic-git Affected before 1.38.6 Fixed in 1.38.6 Patch available CNA
Remediation
Upgrade isomorphic-git to version 1.38.6, which fixes this issue. Red Hat lists no available plan for OpenShift Serverless, Red Hat Developer Hub 1 and Self-service automation portal 2.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA isomorphic-git (isomorphic-git) Fixed in 1.38.6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
Timeline
- 2026-11-03 Threatist record created from CVE-2026-63395
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → HIGH
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
References
Other 4
- https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c
- https://github.com/isomorphic-git/isomorphic-git/pull/2370
- https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b
- https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6
More isomorphic-git vulnerabilities
- TI-2026-84492 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout CVSS 3.1MEDIUM 5.3
- TI-2026-84491 Unbounded memory allocation in isomorphic-git delta handling CVSS 3.1MEDIUM 4.3
- TI-2026-84490 Circular symbolic refs hang ref resolution in isomorphic-git CVSS 3.1MEDIUM 4.3
- TI-2021-06178 Server-side request forgery (SSRF) in @isomorphic-git/cors-proxy CVSS 3.1HIGH 8.6
- TI-2026-60327 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo CVSS 4.0HIGH 7.1
- TI-2021-10885 isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-63395 · CVE Program
- CVE-2026-63395 · NVD
- FIRST EPSS
- CVE-2026-63395 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences