isomorphic-git CVE-2026-63475

Exploitation requires the victim application to clone from a malicious or man-in-the-middle-controlled remote that advertises circular symref= capabilities (e.g. refs/remotes/origin/a pointing to b and b pointing back to a) using isomorphic-git version 1.38.5 or earlier. No authentication is required on the attacker's remote (PR:N), but the attack is gated on victim-initiated user interaction: the victim must choose to clone from the untrusted/compromised remote (UI:R). After that single clone, the trigger fires on any subsequent operation that resolves the poisoned refs - log, status, checkout, or branch. Limiting factors that reduce real-world risk: applications that only clone from trusted remotes over authenticated/verified transport are not exposed; the flaw is a denial of service only (no data exposure or code execution); and upgrading to 1.38.6 - which adds cycle detection / a default depth limit in GitRefManager.resolve() - is the fix.

This is a genuinely low-to-moderate priority issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, base 4.3) correctly reflects a network-reachable but user-interaction-gated flaw with only limited availability impact and no confidentiality or integrity exposure - the worst outcome is a bricked repository for the consuming application, not host compromise. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with the modest severity. It is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. A public PoC reference exists (spiceoverflow/av5-circular-symref) but it is not verified in the input as working exploit code; even taken at face value it demonstrates a hang, not code execution. The one caveat for defenders: the impact is persistent - once the circular refs are on disk the repository stays unusable until manually cleaned - so while the raw score is low, the effect is more than a transient crash. Net: a real, confirmed defect worth patching on a normal cycle, but not a drop-everything emergency, and its exploitation depends entirely on a victim choosing to clone from an attacker-controlled or MitM'd remote.

An attacker stands up (or MitM-intercepts) a Git remote that advertises circular symref= capabilities such as refs/remotes/origin/a → b and b → a. When a victim application clones from that remote using isomorphic-git ≤ 1.38.5, the circular loose symrefs are written to disk, and the next operation that resolves them - log, status, checkout, or branch - loops forever, leaving the repository permanently unusable. A public PoC reference exists (spiceoverflow/av5-circular-symref); it is not verified as working exploit code, though its runner reportedly confirms the non-terminating resolution.