{"id":"CVE-2026-63478","aliases":["GHSA-cw2g-2vwq-88w6"],"url":"https://o3.security/vulnerability/CVE-2026-63478","summary":"isomorphic-git: Path traversal via a \"..\" tree-entry name writes files outside the working directory on clone/checkout","details":"### Summary\nisomorphic-git's tree parser (`src/models/GitTree.js`) validates each entry name only against the path separators `/` and `\\`. It does not reject the standalone reserved name `..`, so a malicious repository can, on a single `clone`/`checkout`, **write files outside the working\ndirectory** (unbounded depth). Works on any host-backed `fs` provider.\n\n### Details\nThe guard is:\n\n```js\n// src/models/GitTree.js\nif (path.includes('\\\\') || path.includes('/')) {\n  throw new UnsafeFilepathError(path)\n}\n```\n\nThe standalone string `..` passes. isomorphic-git assembles the full path incrementally across tree levels, so nesting `..` trees yields `../escaped.txt`, `../../escaped.txt`, … with unbounded depth (each level is a separate tree object that passes the per-entry guard). On checkout `mkdir(workdir/..)` hits `EEXIST` (ignored) and the file is written above the working directory. Depth is chosen to reach the home dir, `/etc`, `/tmp`, etc.; overwriting a shell rc / config / startup file can escalate to code execution.\n\n#### Canonical git behavior (divergence)\ngit rejects this via `verify_path()`: `git read-tree` fails with `error: invalid path '../escaped.txt'` and `git fsck` flags `warning … hasDotdot: contains '..'`. (git's `verify_path` also rejects `.` and `.git`, the latter flagged by fsck as `hasDotgit` — see the fix note below.) GitHub runs fsck on push, so such a tree can't be hosted there; reach is limited to a self-hosted/Smart-HTTP remote or a MitM.\n\n\n### PoC\n`https://github.com/spiceoverflow/av2-dotdot-traversal` — open in a Codespace; a single `git.clone()` from the bundled server writes `escaped.txt` one directory above the clone target (`DEPTH=N` escapes N levels):\n\n```\n[AV-2] *** PATH TRAVERSAL CONFIRMED ***\n[AV-2] File written outside workdir: …/escaped.txt\n```\n\n### Impact\nA path-traversal arbitrary file write outside the working directory (CWE-22), triggered by a single clone/checkout; it can escalate to code execution by overwriting shell rc, config, or startup files.\n\nAny application or user that clones/checks out an untrusted (or compromised / MitM'd) repository with isomorphic-git on a host-backed filesystem (**Linux, macOS, or Windows** — no symlink or privilege required). Requires a non-GitHub remote (self-hosted / Smart-HTTP) or a MitM, since GitHub's fsck rejects trees containing `..`.\n\n### Suggested fix\nIn the tree parser, reject any entry name equal to `.` or `..`. For full `verify_path` parity it should **also** reject `.git` (case-insensitively, trailing dots/spaces stripped) and the NTFS 8.3 / HFS variants git blocks. Note: a literal `.git` entry is *not* independently exploitable via\n`clone`/`checkout` in current isomorphic-git — the checkout walk skips a `.git` tree entry (a sibling file is written but the `.git` entry is not), so rejecting `.git` is defense-in-depth / git parity rather than a separately demonstrated bug. Additionally, normalize and bounds-check the assembled full path against the working-tree root before any filesystem write.","published":"2026-11-03T19:39:52.188Z","modified":"2026-11-08T02:30:46.038289052Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"isomorphic-git","fixedVersion":"1.38.6"}],"fix":{"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","label":"isomorphic-git/isomorphic-git@823843d"},"references":[{"type":"WEB","url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63478.json"},{"type":"ADVISORY","url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63478"},{"type":"FIX","url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"},{"type":"FIX","url":"https://github.com/isomorphic-git/isomorphic-git/pull/2370"},{"type":"PACKAGE","url":"https://github.com/isomorphic-git/isomorphic-git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-08T02:30:46.038289052Z"}}