isomorphic-git 0.31.1

Direct Vulnerabilities

Known vulnerabilities in the isomorphic-git package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Prototype Pollution isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies. Affected versions of this package are vulnerable to Prototype Pollution via the `getRemoteInfo` function. An attacker can manipulate the prototype of objects by advertising crafted ref names containing `__proto__` path segments during ref negotiation, which can reroute network operations through an attacker-controlled proxy and result in the transmission of sensitive credentials by invoking the victim's authentication callback when connecting to a malicious server. How to fix Prototype Pollution? Upgrade `isomorphic-git` to version 1.42.0 or higher.	<1.42.0
C Directory Traversal isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies. Affected versions of this package are vulnerable to Directory Traversal via a crafted repository. How to fix Directory Traversal? Upgrade `isomorphic-git` to version 1.8.2 or higher.	<1.8.2

Vulnerability

Vulnerable Version

Prototype Pollution

isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.

Affected versions of this package are vulnerable to Prototype Pollution via the getRemoteInfo function. An attacker can manipulate the prototype of objects by advertising crafted ref names containing __proto__ path segments during ref negotiation, which can reroute network operations through an attacker-controlled proxy and result in the transmission of sensitive credentials by invoking the victim's authentication callback when connecting to a malicious server.

How to fix Prototype Pollution?

Upgrade isomorphic-git to version 1.42.0 or higher.

<1.42.0

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via a crafted repository.

How to fix Directory Traversal?

Upgrade isomorphic-git to version 1.8.2 or higher.

<1.8.2

isomorphic-git@0.31.1

A pure JavaScript reimplementation of git for node and browsers

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically