Executive brief
isomorphic-git is a JavaScript Git client library used to interact with Git repositories from web and Node.js applications. A malicious Git server can exploit a prototype pollution vulnerability to hijack network connections, intercept authentication credentials, and route traffic through an attacker-controlled proxy when a victim queries the server's repository information.
Technical details
The vulnerability is a prototype pollution flaw in the getRemoteInfo function that occurs during Git ref negotiation. When a malicious Git server advertises crafted ref names containing '__proto__' path segments (e.g., '__proto__/corsProxy'), the vulnerable code pollutes Object.prototype without proper validation. An attacker controlling a Git server can leverage this to reroute all subsequent network operations through their proxy, intercept the onAuth callback, and steal credentials transmitted by the victim. The attack requires the victim to call getRemoteInfo with an attacker-supplied URL but does not require pre-existing authentication or elevated privileges. A fix was merged in commit b3db111 and released in version 1.42.0.
Affected products
- isomorphic-git isomorphic-git before 1.42.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 1.42.0 via commit b3db111