Prototype Pollution

isomorphic-git is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of ref names in the getRemoteInfo function, where a malicious Git server can advertise crafted ref names containing proto path segments e.g., proto/corsProxy that pollute Object.prototype, and...