Isomorphic-git vulnerabilities
We track 2 vulnerabilities in Isomorphic-git products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score
Latest Isomorphic-git vulnerabilities
- 8.8 High severity
isomorphic-git: Improper Limitation of a Pathname to a Restricted Directory
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first pla
- 7.1 High severity
isomorphic-git: Improperly Controlled Modification of Object Prototype Attributes
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref neg