EUVD-2026-116269

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout...

GHSA-CW2G-2VWQ-88W6 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

Summary isomorphic-git's tree parser src/models/GitTree.js validates each entry name only against the path separators / and . It does not reject the standalone reserved name .., so a malicious repository can, on a single clone/checkout, write files outside the working directory unbounded depth...

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

Summary isomorphic-git's tree parser src/models/GitTree.js validates each entry name only against the path separators / and . It does not reject the standalone reserved name .., so a malicious repository can, on a single clone/checkout, write files outside the working directory unbounded depth...

Directory Traversal

Overview org.webjars.npm:isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affect...

Directory Traversal

Overview isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affected versions of...

CVE-2026-63478

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

CVE-2026-63478 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

CVE-2026-63478 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

CVE-2026-63478 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

CVE-2026-63478

The isomorphic-git library (a JavaScript implementation of Git for Node.js and browsers) contains a path traversal vulnerability in its tree parser located at src/models/GitTree.js. Prior to version 1.38.6 , the parser accepts a standalone .. tree-entry name because it only rejects path separator...

CVE-2026-63478

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...

PT-2026-136370

Name of the Vulnerable Software and Affected Versions isomorphic-git versions prior to 1.38.6 Description The tree parser in src/models/GitTree.js accepts standalone .. tree-entry names because it only rejects path separators. When performing a clone or checkout from a malicious or...

Isomorphic-Git path traversal vulnerability

Versions of isomorphic-git prior to 1.38.6 contain a path traversal vulnerability. This vulnerability arises because the tree parser in src/models/GitTree.js only rejects path separators; it accepts standalone.. entries as file names. When a maliciously crafted or man-in-the-middle-controlled...

CVE-2026-63478: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or...