CVE-2026-63395

Name of the Vulnerable Software and Affected Versions isomorphic-git versions prior to 1.38.6

Description The git.checkout() function writes new child paths through symlinked leading directory components without proper validation. A malicious repository can create a directory symlink and subsequently replace the tree state with a child file under that path. This can be triggered during a clone followed by a pull, or during a single clone if a symlink already exists. On Linux or macOS using Node fs, the operating system may resolve the write outside the working tree, allowing arbitrary host file writes and potential code execution. On Windows, Node fs typically blocks symlink creation without elevated privileges. Browser or in-memory providers are limited to their virtual filesystem and are only affected if they support symlink creation and following.

Recommendations Update to version 1.38.6.