isomorphic-git CVE-2026-63395

Requires a consuming application using isomorphic-git <= 1.38.5 with the Node fs provider on Linux or macOS, processing an attacker-controlled repository via git.checkout. The concrete trigger is a clone that checks out commit N (planting 'config' as a directory symlink to a target such as ~/.ssh or .git) followed by a later pull checking out commit N+1 (adding a child path like 'config/authorized_keys'); a single clone also triggers it when the symlink already exists on disk or the app reads/writes into the cloned tree. Limiting factors that reduce real-world risk: user interaction is needed (clone/pull of an untrusted repo); Node fs on Windows typically throws EPERM on symlink creation so it is not exploitable without privilege; and browser or in-memory providers (memfs, ZenFS, lightning-fs) confine impact to their virtual filesystem and are affected only if they implement symlink creation and following. The only complete fix per the vendor is updating to 1.38.6.

Signals mostly align toward a genuine priority but fall short of emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects the worst case - Node fs on a POSIX host - where a malicious repository yields arbitrary host file write and likely RCE. UI:R is accurate and meaningful: exploitation needs the victim to clone and later pull (or clone a repo where a symlink already exists), so this is not drive-by; it requires processing an attacker-controlled repository. The vuln.today decision label is 'this_week', consistent with high technical impact but no confirmed mass exploitation. No CISA KEV entry is present in the input, so this is NOT confirmed actively exploited. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. A public PoC reference is provided (spiceoverflow/av1-symlink-hook-rce) and the GHSA shows confirmed SSH-key-injection output on Linux, but the input does not carry a 'POC: Publicly available (confirmed)' label, so it is treated as a public PoC reference, not verified working exploit code. The real-risk caveat is deployment-dependent and explicitly stated by the vendor: Node fs on Windows usually blocks the symlink plant (EPERM) and is not exploitable by default, while browser/in-memory providers are sandboxed and affected only if they implement symlink creation and following. So the 8.8 applies to server-side Linux/macOS consumers that process untrusted repos; for Windows-only or browser-only deployments the real-world risk is substantially lower.

A server, CI job, or desktop tool uses isomorphic-git with Node fs on Linux/macOS to clone an attacker-controlled repository (commit N stores 'config' as a directory symlink pointing at, e.g., ~/.ssh or .git), then performs a routine pull (commit N+1 adds 'config/authorized_keys' or 'hooks/pre-commit'); isomorphic-git writes the child file through the leading symlink, landing it outside the working tree. A public PoC reference exists and the advisory demonstrates confirmed SSH key injection, though the input does not mark it as verified working exploit code. Exploitation requires user interaction (the clone/pull of an untrusted repo) but no authentication to the victim.