Quick answers
- Is CVE-2026-89011 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89011 being exploited in the wild.
- How severe is CVE-2026-89011?
- High severity, with a CVSS score of 7.1, published 10 September 2026.
- Which products and versions are affected?
- isomorphic-git isomorphic-git before 1.42.0.
- Is there a fix for CVE-2026-89011?
- A patch was published on 2026-09-10: Fixed in version 1.42.0 via commit b3db111 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89011 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-89011?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a prototype pollution flaw in the getRemoteInfo function that occurs during Git ref negotiation. When a malicious Git server advertises crafted ref names containing '__proto__' path segments (e.g., '__proto__/corsProxy'), the vulnerable code pollutes Object.prototype without proper validation. An attacker controlling a Git server can leverage this to reroute all subsequent network operations through their proxy, intercept the onAuth callback, and steal credentials transmitted by the victim. The attack requires the victim to call getRemoteInfo with an attacker-supplied URL but does not require pre-existing authentication or elevated privileges. A fix was merged in commit b3db111 and released in version 1.42.0.
Affected products
- isomorphic-git isomorphic-git before 1.42.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 1.42.0 via commit b3db111