SB2026080556 - Multiple vulnerabilities in isomorphic-git

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080556

SB2026080556 - Multiple vulnerabilities in isomorphic-git

Published: August 5, 2026

Security Bulletin ID SB2026080556
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 25% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Uncontrolled Recursion (CVE-ID: CVE-2026-63475)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in GitRefManager.resolve() when resolving server-supplied symbolic references written during a clone. A remote attacker can advertise circular symref capabilities to cause a denial of service.

User interaction is required to clone from a malicious or man-in-the-middle server.


2) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-63476)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in src/utils/applyDelta.js when applying a delta object from a packfile during git clone or fetch operations. A remote attacker can send a specially crafted packfile response to cause a denial of service.

User interaction is required to initiate a clone or fetch operation against a malicious or man-in-the-middle server.


3) Path traversal (CVE-ID: CVE-2026-63478)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write files outside the working directory.

The vulnerability exists due to path traversal in src/models/GitTree.js when cloning or checking out a malicious repository. A remote attacker can supply a repository containing tree entries named \"..\" to write files outside the working directory.

User interaction is required to clone or check out the crafted repository, and exploitation is limited to non-GitHub remotes or a machine-in-the-middle scenario because GitHub rejects such trees.


4) Link following (CVE-ID: CVE-2026-63395)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper link resolution before file access in git.checkout when checking out a malicious repository containing a directory symlink. A remote attacker can cause the application to clone or update a crafted repository to write files outside the intended working directory and execute arbitrary code.

User interaction is required to clone, pull, or otherwise process the crafted repository. On sandboxed or in-memory filesystem providers, the impact may be limited to corruption outside the intended clone directory within that virtual filesystem.


Remediation

Install update from vendor's website.

References