Prototype Pollution

isomorphic-git is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of ref names in the getRemoteInfo function, where a malicious Git server can advertise crafted ref names containing proto path segments e.g., proto/corsProxy that pollute Object.prototype, and...

@0xlabs/ipfs-github (>=0.0.1, <=0.0.2), @adiza/sfpowerscripts (>=23.0.0, <=25.0.7) +231 more potentially affected by CVE-2026-89011 via isomorphic-git (>=1.1.4, <=1.41.9)

isomorphic-git NPM version =1.1.4, =0.0.1, =23.0.0, =35.0.0, =15.0.0, =1.3.6, =8.1.0, =1.0.0, =5.1.1, =1.0.0, =2.9.0, =1.0.24, =0.0.1-AHG-001, =0.0.1-AHG-001, =1.0.0, =1.2.0 and more Source cves: CVE-2026-89011 Source advisory: SNYK:JS-ISOMORPHICGIT-19784422...

Prototype Pollution

Overview org.webjars.npm:isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affect...

Prototype Pollution

Overview isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affected versions of...

CVE-2026-89011

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011

A flaw was found in isomorphic-git. This prototype pollution vulnerability in the getRemoteInfo function allows a malicious Git server operator to manipulate object properties by advertising specially crafted reference names. This can reroute network operations through an attacker-controlled prox...

@0xlabs/ipfs-github (>=0.0.1, <=0.0.2), @aatishgh/antora_site_generator_lunr_custom (>=0.4.0, <=0.4.3) +334 more potentially affected by CVE-2026-89011 via isomorphic-git (>=0.11.3, <=1.41.9)

isomorphic-git NPM version =0.11.3, =0.0.1, =0.4.0, =23.0.0, =35.0.0, =15.0.0, =1.0.1, =0.9.12-pre.2, =0.3.0-SNAPSHOT.293, =1.0.0, =2.6.0, =1.0.0, =2.9.0, =1.0.24, =1.0.5-SNAPSHOT.105, =0.0.1-AHG-001, =0.0.1-AHG-002 and more Source cves: CVE-2026-89011 Source advisory: MEND:CVE-2026-89011...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

EUVD-2026-75710

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011

isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011: Improperly Controlled Modification of Object Prototype Attributes

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

PT-2026-89581

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing ' proto ' path segments during ref negotiation. Attackers controlling a Git...

django-buckets (>=0.1.1, <=0.1.5), django-isomorphic (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-15307 via django (1.9.0)

django PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-buckets =0.1.1, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - kwikapi-django 0.0.1 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

django-buckets (>=0.1.1, <=0.1.5), django-isomorphic (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-15830 via django (1.9.0)

django PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-buckets =0.1.1, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - kwikapi-django 0.0.1 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

CLSA-2026-1775694709 TuxCare security update for isomorphic-dompurify (1 CVE)

TuxCare rebuilt isomorphic-dompurify to address 1 CVE. Fixed in 2.36.0-tuxcare.1...

PT-2026-74377

TuxCare rebuilt isomorphic-dompurify to address 1 CVE. Fixed in 2.36.0-tuxcare.1...

django-buckets (>=0.1.1, <=0.1.5), django-isomorphic (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-53878 via django (1.9.0)

django PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-buckets =0.1.1, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - kwikapi-django 0.0.1 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

django-buckets (>=0.1.1, <=0.1.5), django-isomorphic (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-53877 via django (1.9.0)

django PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-buckets =0.1.1, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - kwikapi-django 0.0.1 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...