CVE-2026-63395: isomorphic-git symlink path traversal in checkout

CVE-2026-63395 · Severity: high · CVSS 8.8 · Published 2026-11-03

isomorphic-git is a JavaScript Git implementation used in Node.js and browser environments. A flaw in its git.checkout function allows writing files outside the intended working directory by following symbolic links placed in parent directory paths. An attacker controlling a malicious repository can achieve arbitrary file writes on the host system, potentially leading to code execution on Linux and macOS systems, while Windows and browser environments have limited exposure.

Technologies: Isomorphic-Git, isomorphic-git (npm). Vendors: Isomorphic-Git, npm.

Quick answers

Is CVE-2026-63395 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63395 being exploited in the wild.
How severe is CVE-2026-63395?
High severity, with a CVSS score of 8.8, published 3 November 2026.
Which products and versions are affected?
Isomorphic-Git prior to 1.38.6; isomorphic-git (npm) <= 1.38.5, SEMVER:introduced=0,fixed=1.38.6.
Is there a fix for CVE-2026-63395?
Yes. isomorphic-git (npm): upgrade to 1.38.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63395 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63395?
Check whether you run Isomorphic-Git or isomorphic-git (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • isomorphic-git (npm): upgrade to 1.38.6 or later
    npm install isomorphic-git@1.38.6

Technical details

The vulnerability is a path traversal flaw in the git.checkout operation where symlinked leading directory components are not validated before writing child paths. An attacker can first insert a directory symlink into the repository and later replace it with a tree containing a child file, triggering the vulnerability during clone or pull operations. On Node.js with Linux/macOS file systems, the OS resolves symlinks during writes, allowing files to be written outside the working tree; Windows typically blocks this without elevated privileges, and browser/in-memory providers are limited to their virtual filesystem.

Affected products

  • isomorphic-git isomorphic-git prior to 1.38.6

Identifiers

  • CVE-2026-63395
  • GHSA-9qw7-j9xw-fv9c

Timeline

  • 2026-11-03: disclosed
  • 2026-07-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.