Skip to content

An editorial team and a community building with AI

vibecoding.incJoin Discord ↗
← All articles

News · isomorphic-git (open source) · 2 min read

Event date: · Published:

High-severity symlink flaw in isomorphic-git enables arbitrary file write

A path-traversal vulnerability in isomorphic-git, CVE-2026-63395, lets a malicious repository write files outside the working directory via a symlink. The fix ships in version 1.38.6.

On November 9, 2026, GitHub Security Advisories and the isomorphic-git project disclosed a high-severity vulnerability in isomorphic-git, a JavaScript git implementation embedded in many development tools, CI pipelines, and desktop or Electron based git clients. The advisory describes a path-traversal flaw that lets checkout operations write files outside the intended working directory through a directory symlink planted by a malicious repository, detailed in the isomorphic-git security advisory GHSA-9qw7-j9xw-fv9c.

Key details of the flaw

  • Tracked as CVE-2026-63395, GitHub Security Advisory GHSA-9qw7-j9xw-fv9c, with a CVSS 3.1 score of 8.8 (High severity)
  • Classified under CWE-22 (path traversal) and CWE-59 (improper link resolution)
  • git.checkout writes working-tree files through a directory symlink without validating the leading path
  • A malicious repository can plant a symlink in one commit, then write outside the working directory, for example into ~/.ssh or the repo's own .git, in a second commit
  • The flaw sits in isomorphic-git's own checkout logic and is independent of the filesystem backend used
  • All versions up to and including 1.38.5 are affected; the fix ships in 1.38.6

What it means for people who build with AI

isomorphic-git is widely embedded in Node.js servers, CI automation, CLIs, and Electron or desktop git clients, including some coding-agent sandboxes that check out arbitrary repositories. Any of those tools left on an unpatched version is exposed to arbitrary file write, and potentially remote code execution, simply by cloning or checking out a crafted repository.

What to do now

Teams that embed isomorphic-git, directly or through a dependency, should update to version 1.38.6, where the fix applies regardless of which filesystem backend the integration uses. The advisory was published November 9, 2026, at 19:53 UTC.

Sources

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.

High-severity symlink flaw in isomorphic-git enables arbitrary file write | vibecoding.inc