GHSA-cw2g-2vwq-88w6: isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
isomorphic-gitto a version that resolves this vulnerability.Fixed in 1.38.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using isomorphic-git before 1.38.6 are exposed when clone or checkout operations use a host-backed filesystem provider and process a malicious or man-in-the-middle-controlled non-GitHub remote. GitHub-hosted repositories are not a direct source because GitHub rejects tree entries named ".." during repository integrity checks.
What must an attacker control to exploit the vulnerability?
An attacker must cause the victim to clone or check out repository content containing nested tree entries named "..". This can come from a malicious non-GitHub remote or a man-in-the-middle-controlled remote; no authentication is required, but user interaction is required to initiate the clone or checkout.
What is the impact of a successful exploit?
Nested ".." entries can escape the working-tree root and write files to attacker-selected parent paths. Those writes can overwrite startup or configuration files and may lead to code execution.
What should be done if an immediate upgrade is not possible?
Avoid cloning from or checking out untrusted non-GitHub remotes, and avoid operations where a network attacker could control or modify the remote repository content. The provided data does not identify another technical mitigation.