isomorphic-git CVE-2026-89011

The victim application must call getRemoteInfo (or any isomorphic-git function that performs Git ref advertisement) with a URL pointing to an attacker-controlled Git server. The attacker must operate a server capable of sending a non-standard Git ref advertisement response containing path segments like '__proto__'. Credential theft additionally requires that the victim application has registered an onAuth callback that returns credentials and that an authenticated operation is subsequently performed in the same JavaScript runtime after prototype pollution occurs. Exploitation is limited by the requirement that the victim initiate a connection to the malicious server - purely passive reception of network traffic is insufficient. The attack does not require any special configuration of isomorphic-git itself; default setups with onAuth credential handling are vulnerable. Users who never pass externally-supplied URLs into isomorphic-git remote functions are not at risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L) reflects a low-complexity network attack with passive user interaction - meaning the victim need only call getRemoteInfo normally against an attacker-supplied URL for exploitation to succeed. The VC:H rating is appropriate given that full Git credentials (usernames, passwords, tokens) surfaced via onAuth can be exfiltrated. VI:L captures the secondary integrity risk from global Object.prototype mutation, which can subtly alter runtime behavior across the entire isomorphic-git process. No EPSS data was included in the input, no KEV listing exists, and no public exploit code has been identified, so real-world exploitation risk is moderate but not confirmed as active. The primary amplifying factor is that developer tooling and CI pipelines that dynamically accept user-supplied remote URLs are plausible targets, particularly in browser-based Git clients where the onAuth credential flow is a core workflow. The UI:P constraint meaningfully limits opportunistic mass exploitation - the attacker must cause the victim to initiate a getRemoteInfo call toward the malicious server.

An attacker operates a Git server that advertises a crafted ref named '__proto__/corsProxy' pointing to an attacker-controlled HTTPS endpoint during the Git ref advertisement handshake. When a victim application calls isomorphic-git's getRemoteInfo with the attacker's server URL - for example, via a repository clone link presented in a pull request, issue comment, or user-configurable repository field - Object.prototype.corsProxy is set to the attacker's proxy URL. All subsequent isomorphic-git network requests in that JavaScript runtime then route through the attacker's proxy, and when an authenticated operation triggers the onAuth callback, the victim's credentials are transmitted to and logged by the attacker's infrastructure.