CVE-2026-63395

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later...

CVE-2026-63395 isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later...

CVE-2026-63395

The isomorphic-git library (prior to version 1.38.6 ) is vulnerable to arbitrary host file writes and potential code execution. The git.checkout function fails to validate leading directory components, allowing a malicious repository to use a directory symlink to write files outside the intended ...

EUVD-2026-116274

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later...