Path traversal in isomorphic-git - CVE-2026-63478
Published: August 5, 2026
Vulnerability identifier: #VU141014
CSH Severity: Medium
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63478
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write files outside the working directory.
The vulnerability exists due to path traversal in src/models/GitTree.js when cloning or checking out a malicious repository. A remote attacker can supply a repository containing tree entries named \"..\" to write files outside the working directory.
User interaction is required to clone or check out the crafted repository, and exploitation is limited to non-GitHub remotes or a machine-in-the-middle scenario because GitHub rejects such trees.
Affected software
isomorphic-git
How to mitigate CVE-2026-63478
Install security update from vendor's website.
isomorphic-git - update to 1.38.6