CVE-2026-89011
Received Received - Intake

Prototype Pollution in isomorphic-git

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-89011
EUVD
EUVD-2026-75710

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
isomorphic_git isomorphic_git to 1.42.0 (exc)
isomorphic-git isomorphic-git to 1.42.0 (exc)
isomorphic-git isomorphic-git 1.40.0
isomorphic-git isomorphic-git 1.41.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a prototype pollution issue in the isomorphic-git library before version 1.42.0. It occurs in the getRemoteInfo function where a malicious Git server operator can craft ref names containing '__proto__' segments. This pollutes the Object.prototype, allowing the attacker to reroute network operations through their proxy. When a victim calls getRemoteInfo with an attacker-controlled URL, credentials may be transmitted to the attacker.

Detection Guidance

Detecting this vulnerability requires checking the version of isomorphic-git in use. Run 'npm list isomorphic-git' or 'yarn list isomorphic-git' to verify if the installed version is below 1.42.0. If so, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of isomorphic-git, an attacker controlling a Git server could intercept your credentials or manipulate network requests. This happens when you call getRemoteInfo with a URL provided by the attacker, causing your credentials to be sent to their proxy server.

Mitigation Strategies

Immediately update isomorphic-git to version 1.42.0 or later using 'npm update isomorphic-git' or 'yarn upgrade isomorphic-git'. If updating is not possible, review and sanitize all ref names from untrusted Git servers to avoid '__proto__' segments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart