Isomorphic Git
Monthly
Prototype pollution in isomorphic-git before 1.42.0 allows an operator of a malicious Git server to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation, enabling credential theft when the victim's onAuth callback is triggered. The getRemoteInfo function fails to sanitize ref path components before using them as property keys on JavaScript objects, so a ref such as '__proto__/corsProxy' causes all subsequent network operations within the affected isomorphic-git instance to route through an attacker-controlled proxy. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in v1.42.0 released 2026-09-10.
Non-terminating symbolic-reference resolution in isomorphic-git 1.38.5 and earlier lets a malicious or man-in-the-middle-controlled Git remote brick a client repository: circular symref= capabilities advertised by the server are persisted to disk by updateRemoteRefs, and any later operation that resolves refs/remotes/origin/a or refs/remotes/origin/b (log, status, checkout, branch) hangs indefinitely. The attack is gated on the victim choosing to clone from the untrusted or compromised remote (UI:R, PR:N), and the result is a persistent denial of service only - no data exposure or code execution (CVSS 3.1 base 4.3, A:L). No CISA KEV entry or confirmed in-the-wild exploitation is reported; the GHSA advisory references a public proof-of-concept repository demonstrating the hang, which is a PoC reference rather than exploit code independently verified as working.
Unbounded memory allocation in isomorphic-git before 1.38.6 allows a malicious or man-in-the-middle-controlled Git remote to force git.clone() or git.fetch() to allocate roughly 2 GB from a single packfile delta, causing denial of service on memory-constrained hosts. The server-controlled delta targetSize is passed to Buffer.alloc without an upper bound in src/utils/applyDelta.js, and Node.js heap limits do not mitigate the off-heap allocation. The vendor fixed this in 1.38.6; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation confirmation is provided.
Path traversal (CWE-22) in isomorphic-git up to and including 1.38.5 lets a malicious or man-in-the-middle-controlled non-GitHub remote write attacker-chosen files outside the working-tree root when a victim clones or checks out that repository, and overwriting shell rc, configuration or startup files can escalate the write into code execution. Affected are Node.js and browser deployments using any host-backed fs provider on Linux, macOS or Windows; the issue is unauthenticated (PR:N in the vector) but requires user-initiated clone/checkout of untrusted content (UI:R) and a non-GitHub remote, because GitHub runs fsck on push and rejects '..' entries, and escalation further depends on a writable security-relevant parent-path file existing. A public PoC reference demonstrating the escape write exists; it is not verified as working exploit code, there is no CISA KEV listing, and the overall priority is moderate rather than an emergency.
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Prototype pollution in isomorphic-git before 1.42.0 allows an operator of a malicious Git server to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation, enabling credential theft when the victim's onAuth callback is triggered. The getRemoteInfo function fails to sanitize ref path components before using them as property keys on JavaScript objects, so a ref such as '__proto__/corsProxy' causes all subsequent network operations within the affected isomorphic-git instance to route through an attacker-controlled proxy. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in v1.42.0 released 2026-09-10.
Non-terminating symbolic-reference resolution in isomorphic-git 1.38.5 and earlier lets a malicious or man-in-the-middle-controlled Git remote brick a client repository: circular symref= capabilities advertised by the server are persisted to disk by updateRemoteRefs, and any later operation that resolves refs/remotes/origin/a or refs/remotes/origin/b (log, status, checkout, branch) hangs indefinitely. The attack is gated on the victim choosing to clone from the untrusted or compromised remote (UI:R, PR:N), and the result is a persistent denial of service only - no data exposure or code execution (CVSS 3.1 base 4.3, A:L). No CISA KEV entry or confirmed in-the-wild exploitation is reported; the GHSA advisory references a public proof-of-concept repository demonstrating the hang, which is a PoC reference rather than exploit code independently verified as working.
Unbounded memory allocation in isomorphic-git before 1.38.6 allows a malicious or man-in-the-middle-controlled Git remote to force git.clone() or git.fetch() to allocate roughly 2 GB from a single packfile delta, causing denial of service on memory-constrained hosts. The server-controlled delta targetSize is passed to Buffer.alloc without an upper bound in src/utils/applyDelta.js, and Node.js heap limits do not mitigate the off-heap allocation. The vendor fixed this in 1.38.6; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation confirmation is provided.
Path traversal (CWE-22) in isomorphic-git up to and including 1.38.5 lets a malicious or man-in-the-middle-controlled non-GitHub remote write attacker-chosen files outside the working-tree root when a victim clones or checks out that repository, and overwriting shell rc, configuration or startup files can escalate the write into code execution. Affected are Node.js and browser deployments using any host-backed fs provider on Linux, macOS or Windows; the issue is unauthenticated (PR:N in the vector) but requires user-initiated clone/checkout of untrusted content (UI:R) and a non-GitHub remote, because GitHub runs fsck on push and rejects '..' entries, and escalation further depends on a writable security-relevant parent-path file existing. A public PoC reference demonstrating the escape write exists; it is not verified as working exploit code, there is no CISA KEV listing, and the overall priority is moderate rather than an emergency.
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.