CVE-2026-63395
Deferred Deferred - Pending Action

isomorphic-git Symlink-Based Arbitrary File Write via git.checkout

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63395
EUVD
EUVD-2026-116274

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
isomorphic-git isomorphic-git < 1.38.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63395 is a high-severity vulnerability in the isomorphic-git library affecting versions before 1.38.6. It involves improper handling of symlinks during Git checkout operations. A malicious repository can exploit this by placing a directory symlink and later adding a file beneath it. When checked out, the file is written outside the intended working directory due to the unresolved symlink, potentially allowing arbitrary file writes on the host system.

Detection Guidance

To detect this vulnerability, check if your system uses isomorphic-git versions prior to 1.38.6. Run: npm list isomorphic-git or grep "isomorphic-git" package.json. If vulnerable, update immediately to 1.38.6 or later.

Impact Analysis

This vulnerability can lead to arbitrary file writes outside the working tree, potentially enabling remote code execution (RCE) on affected systems. On Linux or macOS with Node.js fs, an attacker could write files like SSH keys to sensitive locations (e.g., ~/.ssh/authorized_keys). Windows typically blocks exploitation due to permission requirements. Browser or in-memory providers limit impact to their virtual filesystem.

Mitigation Strategies

Immediately update isomorphic-git to version 1.38.6 or later. Review repositories using the library for suspicious commits with symlinks or unusual file paths. Monitor filesystem writes outside expected directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...