isomorphic-git: arbitrary file write / RCE via directory symlink during checkout (CVE-2026-63395)
Severity: high · Patch status: patched · Since 2026-11-09 · CVE-2021-21300, CVE-2024-32002, CVE-2026-63395
isomorphic-git's git.checkout follows a directory symlink planted in the working tree without checking leading path components, unlike canonical git's hassymlinkleadingpath() hardening. A malicious repo uses two commits — first a symlink (e.g. config → ../.ssh), then a tree at the same name containing a payload file — so a later checkout/pull writes through the symlink outside the working directory. On Node fs under Linux/macOS this yields arbitrary file write and RCE (SSH key injection or .git/hooks/.git/config overwrite); Windows and in-memory/browser fs providers are largely unaffected. All versions ≤1.38.5 are affected; fixed in 1.38.6 (commit 823843d) by lstat-checking each leading path component before writes. A public PoC exists; no in-the-wild exploitation reported.
What to do
- Upgrade isomorphic-git to 1.38.6 or later wherever the package runs with Node fs on POSIX hosts (servers, CI, CLIs, Electron apps)
- Audit dependencies and lockfiles for isomorphic-git and rebuild/pin the patched version
- Avoid checking out or pulling untrusted repositories with vulnerable versions; treat existing clones of untrusted repos as potentially tainted
- Consider setting core.symlinks=false or running checkout in sandboxed environments until patched
- Monitor for unexpected symlinks or writes outside working trees in CI and build systems
Fixed versions
Sources
All live incidents on Threat Watch
