Link following in isomorphic-git - CVE-2026-63395
Published: August 5, 2026
Vulnerability identifier: #VU141015
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63395
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper link resolution before file access in git.checkout when checking out a malicious repository containing a directory symlink. A remote attacker can cause the application to clone or update a crafted repository to write files outside the intended working directory and execute arbitrary code.
User interaction is required to clone, pull, or otherwise process the crafted repository. On sandboxed or in-memory filesystem providers, the impact may be limited to corruption outside the intended clone directory within that virtual filesystem.
Affected software
isomorphic-git
How to mitigate CVE-2026-63395
Install security update from vendor's website.
isomorphic-git - update to 1.38.6