CVE-2026-63395 Details

A vulnerability in isomorphic-git, a JavaScript implementation of Git for Node.js and browsers, allows for arbitrary file writes outside the intended working directory via directory symlinks. This issue affects versions prior to 1.38.6. The vulnerability arises during the checkout process, where the leading path components are not properly checked for symlinks. As a result, a malicious repository can exploit this by first creating a symlinked directory and then replacing it with a file, which is then written outside the working tree. On Linux or macOS, this can lead to arbitrary file writes on the host, such as injecting a public key into the SSH authorized_keys file, potentially allowing for remote code execution. While the vulnerability is not typically exploitable on Windows due to symlink restrictions, it can impact browser or in-memory providers if they implement symlink handling and are accessed during the exploitation window.

Users can update to isomorphic-git version 1.38.6 or later, where this vulnerability has been fixed.