isomorphic-git
npm4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting isomorphic-gitpage 1 of 1
- CVE-2021-30483MEDIUMCVSS 5.3EG 5.3fixed in 1.8.22021-07-30
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
- CVE-2026-63395HIGHCVSS 8.8EG 8.8fixed in 1.38.62026-11-03
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious rep…
- CVE-2026-63475MEDIUMCVSS 4.3EG 4.3fixed in 1.38.62026-11-03
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the re…
- CVE-2026-63478MEDIUMCVSS 5.3EG 5.3fixed in 1.38.62026-11-03
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. Dur…
Check whether isomorphic-git is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for isomorphic-git CVEs against the assets you own.
Book a Demo →