CVE-2026-63478

Name of the Vulnerable Software and Affected Versions isomorphic-git versions prior to 1.38.6

Description The tree parser in src/models/GitTree.js accepts standalone .. tree-entry names because it only rejects path separators. When performing a clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root. This allows an attacker to write files to selected parent paths on any host-backed fs provider, potentially overwriting startup or configuration files to achieve code execution.

Recommendations Update to version 1.38.6.