# CVE-2026-63478: isomorphic-git path traversal in tree parser

Source: https://junglewise.ai/threats/cve-2026-63478-isomorphic-git-is-a-pure-javascript-implementation-of-git-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-63478 · Severity: medium · CVSS 5.3 · Published 2026-11-03

isomorphic-git is a JavaScript Git implementation used in Node.js and web applications. The library's tree parser failed to properly validate entry names, allowing attackers to use .. entries to escape the working directory and write arbitrary files to parent directories during clone or checkout operations from untrusted repositories. An attacker can overwrite configuration or startup files to achieve code execution on the host system.

Technologies: [Isomorphic-Git](https://junglewise.ai/threats/technologies/isomorphic-git-isomorphic-git), [isomorphic-git (npm)](https://junglewise.ai/threats/technologies/isomorphic-git). Vendors: [Isomorphic-Git](https://junglewise.ai/threats/vendors/isomorphic-git), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-63478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63478 being exploited in the wild.

**How severe is CVE-2026-63478?** Medium severity, with a CVSS score of 5.3, published 3 November 2026.

**Which products and versions are affected?** Isomorphic-Git before 1.38.6; isomorphic-git (npm) <= 1.38.5, SEMVER:introduced=0,fixed=1.38.6.

**Is there a fix for CVE-2026-63478?** Yes. isomorphic-git (npm): upgrade to 1.38.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63478 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63478?** Check whether you run Isomorphic-Git or isomorphic-git (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- isomorphic-git (npm): upgrade to 1.38.6 or later

  ```sh
  npm install isomorphic-git@1.38.6
  ```


## Technical details

The GitTree.js parser accepts .. as a valid tree entry name because it only rejects path separators, not the .. directory reference itself. During clone or checkout from a malicious or MITM-controlled remote, nested .. entries can traverse outside the working-tree root and write files at attacker-selected paths on host-backed filesystems. The vulnerability requires the victim to clone or checkout from an untrusted remote (GitHub-hosted repositories are safe due to server-side integrity checks).

## Affected products

- isomorphic-git isomorphic-git before 1.38.6

## Identifiers

- CVE-2026-63478
- GHSA-cw2g-2vwq-88w6

## Timeline

- 2026-11-03: disclosed
- 2026-07-01: patched

## References

- [https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b](https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b)
- [https://github.com/isomorphic-git/isomorphic-git/pull/2370](https://github.com/isomorphic-git/isomorphic-git/pull/2370)

## Related threats

- [isomorphic-git unbound buffer allocation in packfile delta](https://junglewise.ai/threats/cve-2026-63476-isomorphic-git-is-a-pure-javascript-implementation-of-git-for)
- [isomorphic-git circular symref denial of service](https://junglewise.ai/threats/cve-2026-63475-isomorphic-git-is-a-pure-javascript-implementation-of-git-for)
- [isomorphic-git symlink path traversal in checkout](https://junglewise.ai/threats/cve-2026-63395-isomorphic-git-is-a-pure-javascript-implementation-of-git-for)
- [isomorphic-git directory traversal via malicious file paths](https://junglewise.ai/threats/cve-2021-30483-isomorphic-git-directory-traversal-via-malicious-file-paths)