isomorphic-git@1.0.0-beta.8

isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.

Affected versions of this package are vulnerable to Directory Traversal via git.checkout, which writes working-tree files through symlinked leading directory components without checking them. A malicious repository can place a directory symlink in one commit and then introduce a child file beneath that path in a subsequent commit; when the consumer checks out the later state, isomorphic-git mkdirs the parent (already a symlink, EEXIST ignored) and then writes the file, which the OS resolves through the symlink to a location outside the working directory. On Node.js with a POSIX filesystem this permits arbitrary host file writes and potential code execution, for example by injecting an attacker-controlled key into ~/.ssh/authorized_keys or overwriting .git/hooks to achieve RCE on the next native git invocation.

Note: Full arbitrary file write impact requires Node.js fs on Linux or macOS; Node.js on Windows typically blocks the symlink creation step without elevated privilege, and browser or in-memory fs providers are affected only when they implement both symlink creation and following, limiting impact to their virtual filesystem.

Upgrade isomorphic-git to version 1.38.6 or higher.

isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via applyDelta in src/utils/applyDelta.js, which reads a server-controlled targetSize from a packfile delta header and passes it directly to Buffer.alloc(targetSize) with no upper bound. A malicious or MitM-controlled remote can send a single delta header declaring a targetSize of approximately 2 GB, causing git.clone() or git.fetch() to perform that allocation before any validation of the actual delta output. Because GitPackIndex.fromPack swallows the subsequent size-mismatch error, hosts with sufficient memory silently waste the allocated resource, while memory-constrained environments such as containers, serverless functions, and small virtual machines are terminated by the OS. The allocation is off-heap, so Node.js heap limits do not mitigate it.

Upgrade isomorphic-git to version 1.38.6 or higher.

isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.

Affected versions of this package are vulnerable to Directory Traversal via the tree parser in src/models/GitTree.js, which validates entry names only against path separators (/ and \) but does not reject the standalone reserved name ... During a clone or checkout from a malicious or MitM-controlled non-GitHub remote, an attacker can nest .. tree entries to assemble paths such as ../escaped.txt or ../../escaped.txt, writing files at arbitrary parent paths outside the working-tree root on any host-backed filesystem. The arbitrary file write can overwrite shell rc, configuration, or startup files and escalate to code execution.

Note: This is only exploitable against non-GitHub remotes (self-hosted or Smart-HTTP) or via a MitM, because GitHub's fsck rejects trees containing .. entries on push.

Upgrade isomorphic-git to version 1.38.6 or higher.

isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via applyDelta in src/utils/applyDelta.js, which reads a server-controlled targetSize from a packfile delta header and passes it directly to Buffer.alloc(targetSize) with no upper bound. A malicious or MitM-controlled remote can send a single delta header declaring a targetSize of approximately 2 GB, causing git.clone() or git.fetch() to perform that allocation before any validation of the actual delta output. Because GitPackIndex.fromPack swallows the subsequent size-mismatch error, hosts with sufficient memory silently waste the allocated resource, while memory-constrained environments such as containers, serverless functions, and small virtual machines are terminated by the OS. The allocation is off-heap, so Node.js heap limits do not mitigate it.

Upgrade isomorphic-git to version 1.38.6 or higher.

isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes (such as GitHub), all without any native C++ module dependencies.

Affected versions of this package are vulnerable to Prototype Pollution via the getRemoteInfo function. An attacker can manipulate the prototype of objects by advertising crafted ref names containing __proto__ path segments during ref negotiation, which can reroute network operations through an attacker-controlled proxy and result in the transmission of sensitive credentials by invoking the victim's authentication callback when connecting to a malicious server.

Upgrade isomorphic-git to version 1.42.0 or higher.