Isabel Mill

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing ' proto ' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as ' proto /corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.

**Name of the Vulnerable Software and Affected Versions** libgit2 versions 0.27.0 through 1.9.0 **Description** Remote attackers can execute arbitrary commands on an SSH server when the software is built with the libssh2 SSH backend (`USE SSH=libssh2`). The issue occurs because the `gen proto()` function in `ssh libssh2.c` inserts the repository path directly into a shell command string without escaping special characters before passing it to `libssh2 channel exec()`. An attacker can exploit this by crafting a malicious submodule URL in a `.gitmodules` file; when processed during a recursive clone, the remote server's shell interprets the injected shell metacharacters, such as single quotes, semicolons, or pipes, executing commands under the victim's SSH user account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.