CVE-2026-89011: isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as 'proto/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to credential theft?
Applications using isomorphic-git before 1.42.0 are exposed when they call getRemoteInfo with an attacker-supplied Git URL. The attacker must control the Git server and advertise crafted ref names during ref negotiation.
What user interaction is required?
A victim must call getRemoteInfo using the attacker-supplied URL. No authentication or prior privileges are required by the attacker, but credential exposure occurs when isomorphic-git invokes the application's onAuth callback after network operations are rerouted.
What should be done to remediate this issue?
Upgrade isomorphic-git to version 1.42.0 or later. Until upgrading is possible, do not pass untrusted Git repository URLs to getRemoteInfo and avoid supplying credentials through onAuth for such URLs.