Is CVE-2026-63478 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63478 being exploited in the wild.

How severe is CVE-2026-63478?

Medium severity, with a CVSS score of 5.3, published 3 November 2026.

Which products and versions are affected?

Isomorphic-Git before 1.38.6; isomorphic-git (npm) <= 1.38.5, SEMVER:introduced=0,fixed=1.38.6.

Is there a fix for CVE-2026-63478?

Yes. isomorphic-git (npm): upgrade to 1.38.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63478 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63478?

Check whether you run Isomorphic-Git or isomorphic-git (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63478: isomorphic-git path traversal in tree parser

Q: Is there a fix for CVE-2026-63478?

Yes. isomorphic-git (npm): upgrade to 1.38.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63478 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-63478?

Check whether you run Isomorphic-Git or isomorphic-git (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63478 · Severity: medium · CVSS 5.3 · Published 2026-11-03

isomorphic-git is a JavaScript Git implementation used in Node.js and web applications. The library's tree parser failed to properly validate entry names, allowing attackers to use .. entries to escape the working directory and write arbitrary files to parent directories during clone or checkout operations from untrusted repositories. An attacker can overwrite configuration or startup files to achieve code execution on the host system.

Technologies: Isomorphic-Git, isomorphic-git (npm). Vendors: Isomorphic-Git, npm.

Quick answers

Is CVE-2026-63478 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63478 being exploited in the wild.
How severe is CVE-2026-63478?: Medium severity, with a CVSS score of 5.3, published 3 November 2026.
Which products and versions are affected?: Isomorphic-Git before 1.38.6; isomorphic-git (npm) <= 1.38.5, SEMVER:introduced=0,fixed=1.38.6.
Is there a fix for CVE-2026-63478?: Yes. isomorphic-git (npm): upgrade to 1.38.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63478 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63478?: Check whether you run Isomorphic-Git or isomorphic-git (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

isomorphic-git (npm): upgrade to 1.38.6 or later
```
npm install isomorphic-git@1.38.6
```

Technical details

The GitTree.js parser accepts .. as a valid tree entry name because it only rejects path separators, not the .. directory reference itself. During clone or checkout from a malicious or MITM-controlled remote, nested .. entries can traverse outside the working-tree root and write files at attacker-selected paths on host-backed filesystems. The vulnerability requires the victim to clone or checkout from an untrusted remote (GitHub-hosted repositories are safe due to server-side integrity checks).

Affected products

isomorphic-git isomorphic-git before 1.38.6

Identifiers

CVE-2026-63478
GHSA-cw2g-2vwq-88w6

Timeline

2026-11-03: disclosed
2026-07-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.