What is CVE-2026-63395 in isomorphic-git?
CVE-2026-63395 is a critical security flaw identified in isomorphic-git, a pure JavaScript implementation of Git for Node.js and browsers, carrying a CVSS score of 8.8. Prior to version 1.38.6, the git.checkout function writes new child paths through symlinked leading directory components without performing proper validation checks.
This mechanism enables a malicious repository to initially place a directory symlink and subsequently replace the tree state with a child file beneath that specific path. This behavior resembles security issues seen in other software ecosystems like escalada de privilegios local, where improper boundary verification leads to system compromise.
Who is affected by this vulnerability?
Linux and macOS environments running Node fs face the highest risk because the operating system can resolve the write operation completely outside the working tree. This flaw permits arbitrary host file writes and creates pathways for potential remote or local code execution.
Conversely, Node fs on Windows generally blocks symlink planting attempts unless additional privileges are granted. Meanwhile, browser or in-memory providers restrict the impact strictly to their virtual filesystem, remaining vulnerable only if they explicitly implement symlink creation and following.
How does the exploit trigger work?
The issue is typically triggered through a standard repository clone followed by a subsequent pull operation. Additionally, a single clone can trigger the security flaw if a malicious symlink already exists or if a consuming application actively accesses the compromised tree state.
Similar risks involving memory handling and control flows are regularly tracked, akin to vulnerabilidad use-after-free con CVSS 8.4, highlighting the importance of strict pointer and path validation.
How do I protect my applications?
Administrators and developers must upgrade their dependencies to version 1.38.6 or higher where the vulnerability has been fully resolved. You can also review related component security advisories like vulnerabilidad crítica en ActivityStarter.java for broader threat awareness.
Follow these mitigation steps to secure your development pipeline and runtime environments:
- Identify all projects utilizing isomorphic-git by scanning your package manager lockfiles.
- Update the isomorphic-git package to version 1.38.6 or later across all dependent repositories.
- Audit untrusted repositories before executing clone or pull operations in production environments.
- Restrict write permissions and monitor file system activity on critical Linux and macOS hosts.