isomorphic-git CVE-2026-63478

Requires that the victim perform a clone or checkout with isomorphic-git (<= 1.38.5) against a repository the attacker controls on a non-GitHub remote - specifically a self-hosted or Smart-HTTP remote - or that the attacker hold a man-in-the-middle position on the transport. The repository must contain nested '..' tree entries (one per level) to escape the working-tree root to a chosen depth, and the target must use a host-backed fs provider (works on Linux, macOS, and Windows with no symlink or privilege required). Key limiting factors: GitHub-hosted trees are NOT a usable source because GitHub runs fsck on push and rejects '..' entries; exploitation needs user-initiated clone/checkout of untrusted content (UI:R); and impact depends on a writable, security-relevant parent-path file (e.g., shell rc/config/startup) existing to escalate the write to code execution. Authentication is not required (PR:N in the supplied vector).

Signals point to a moderate, not emergency, priority. The input CVSS is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N: network vector and no authentication, but offset by high attack complexity, required user interaction, and impact limited to integrity (arbitrary file write) only. The high complexity is real and grounded in the evidence rather than inferred from a bug class: exploitation requires the victim to clone/checkout from a non-GitHub remote the attacker controls (self-hosted/Smart-HTTP) or a man-in-the-middle position, because GitHub's fsck rejects '..' trees on push, so the common GitHub-hosted workflow is not a direct source. No KEV listing is present and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation status is a public PoC reference, not confirmed in-the-wild use. The vuln.today Decision label is 'this_month', consistent with a genuine but non-urgent fix: a legitimate arbitrary-write-to-code-execution path, gated by attacker control of the remote and a user-initiated clone. Note a possible signal tension: the Tags include 'RCE' and the advisory states code execution is achievable by overwriting shell rc/startup files, yet the CVSS models impact as I:H / C:N / A:N (file write) rather than a direct code-execution metric, so the RCE outcome is a plausible downstream consequence rather than a primitive the base score captures.

An attacker hosts a malicious repository on a self-hosted or Smart-HTTP remote (or intercepts a clone via MitM) containing nested '..' tree entries that the isomorphic-git tree parser fails to reject. When a victim application or user runs a single git.clone() or checkout against that remote on a host-backed filesystem, files are written at attacker-chosen parent paths above the working-tree root, overwriting a shell rc, config, or startup file to achieve code execution. A public PoC reference exists (spiceoverflow/av2-dotdot-traversal); it is not verified in the input as working exploit code, though the advisory reproduces it writing escaped.txt one directory above the clone target.