Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63395— isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

Quick assessment

Affected
isomorphic-git isomorphic-git
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

isomorphic-git 是一个为 Node.js 和浏览器设计的纯 JavaScript 实现的 Git 工具。在 1.38.6 版本之前，isomorphic-git 的 功能在写入新子路径时，若其父目录组件为符号链接，则不会进行安全检查。恶意仓库可先放置一个指向目录的符号链接，随后通过更新树状态，在该路径下创建子文件；通常的触发场景是先执行克隆，之后再进行拉取操作；但在符号链接已存在，或应用程序直接访问树结构时，仅执行一次克隆也可能触发该漏洞。在 Linux 或 macOS 上，Node.js 的 模块允

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63395

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)
Source: CVE Program / CVE List V5
Vulnerability Description
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
isomorphic-git isomorphic-git < 1.38.6 -

II. Public POCs for CVE-2026-63395

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63395

请登录查看更多情报信息。

Other References for CVE-2026-63395 (4)

Same Patch Batch · isomorphic-git · 2026-11-03 · 4 CVEs total

CVE-2026-63478 5.3 MEDIUM isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working
CVE-2026-63476 4.3 MEDIUM isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (Do
CVE-2026-63475 4.3 MEDIUM isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

IV. Related Vulnerabilities

Same product: isomorphic-git
Same vendor: isomorphic-git
Same weakness: CWE-22