npm isomorphic-git vulnerabilities

Latest npm isomorphic-git CVEs

Newest publication first

1. CVE-2026-63395 isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

   Published 2026-11-03

   High·CVSS 8.8 EPSS 0.72%

   isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symli...

2. CVE-2026-63475 isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

   Published 2026-11-03

   Medium·CVSS 4.3 EPSS 0.40%

   isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without...

3. CVE-2026-63478 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

   Published 2026-11-03

   Medium·CVSS 5.3 EPSS 0.30%

   isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

4. CVE-2021-30483 Directory Traversal in isomorphic-git

   Published 2021-07-27

   Medium·CVSS 5.3 EPSS 2.2%

   isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.