CVE-2026-63395

Summary

isomorphic-git prior to 1.38.6 fails to validate symlinked directory components during git.checkout, allowing a malicious repository to write files outside the working tree by first planting a symlink and later updating the tree to target a path beneath it; this can lead to arbitrary file writes on Linux/macOS systems using Node.js fs.

Exploitability

Exploitation requires the attacker to control the Git repository content and trigger checkout (e.g., via clone followed by pull), with UI interaction needed for initial user action, and Node.js on Linux/macOS being required for full impact.

Blast radius

On affected systems, successful exploitation could enable remote code execution via overwriting critical files such as shell profiles or binary executables, or data exfiltration through arbitrary file writes to the host filesystem.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to isomorphic-git version 1.38.6 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.