Isomorphic Git

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:isomorphic-git:isomorphic-git:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorIsomorphic Git (3c840422-f0ce-56e7-8f72-3873d816b2c7)
ProductIsomorphic Git (e2fa1e5f-bb82-50af-a561-513437b787ea)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/isomorphic-git/isomorphic-git purl2cpe 2026-06-01 10:15:15.860625
pkg:npm/isomorphic-git purl2cpe 2026-06-01 10:15:15.860627

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-89011 vulnerable 2026-09-16 04:34:09.561190 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
HIGH (7.1)
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.
Published: 2026-09-10T19:56:25.335Z
Updated: 2026-09-11T20:32:36.479Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-30483 vulnerable 2026-06-08 05:31:51.074267 Details available
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
Published: 2021-07-27T18:21:30.000Z
Updated: 2024-08-03T22:32:41.125Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.