41 matches found
Prototype Pollution
isomorphic-git is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of ref names in the getRemoteInfo function, where a malicious Git server can advertise crafted ref names containing proto path segments e.g., proto/corsProxy that pollute Object.prototype, and...
Prototype Pollution
Overview isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affected versions of...
Prototype Pollution
Overview org.webjars.npm:isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affect...
@0xlabs/ipfs-github (>=0.0.1, <=0.0.2), @adiza/sfpowerscripts (>=23.0.0, <=25.0.7) +223 more potentially affected by CVE-2026-89011 via isomorphic-git (>=1.1.4, <=1.41.9)
isomorphic-git NPM version =1.1.4, =0.0.1, =23.0.0, =35.0.0, =15.0.0, =1.3.6, =8.1.0, =1.0.0, =5.1.1, =1.0.0, =2.9.0, =1.0.24, =0.0.1-AHG-001, =0.0.1-AHG-001, =1.0.0, =1.2.0 and more Source cves: CVE-2026-89011 Source advisory: SNYK:JS-ISOMORPHICGIT-19784422...
CVE-2026-89011
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011
A flaw was found in isomorphic-git. This prototype pollution vulnerability in the getRemoteInfo function allows a malicious Git server operator to manipulate object properties by advertising specially crafted reference names. This can reroute network operations through an attacker-controlled prox...
CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011
isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...
EUVD-2026-75710
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
PT-2026-89581
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing ' proto ' path segments during ref negotiation. Attackers controlling a Git...
CVE-2026-89011: Improperly Controlled Modification of Object Prototype Attributes
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...
EUVD-2021-2052
Malware in sbrugna...
Important: Red Hat Security Advisory: RHV 4.4 SP1 [ovirt-4.5.3-3] security update
Updated RHV packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
isomorphic-git: Directory traversal via a crafted repository
A flaw was found in isomorphic-git. An attacker could cause a Directory Traversal via a crafted filepath in a repository being cloned...
RHEL 8 : RHV 4.4 SP1 [ovirt-4.5.3-3] (RHSA-2023:0074)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0074 advisory. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to...
GHSA-V82V-RQ72-PHQ9 Server side request forgery in @isomorphic-git/cors-proxy
The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...
Server side request forgery in @isomorphic-git/cors-proxy
The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...
