CVE-2026-63478

The isomorphic-git library (a JavaScript implementation of Git for Node.js and browsers) contains a path traversal vulnerability in its tree parser located at src/models/GitTree.js. Prior to version 1.38.6 , the parser accepts a standalone .. tree-entry name because it only rejects path separator...