AIKIDO-2026-568462

isomorphic-git is vulnerable to Path Traversal

Path Traversal Pre-CVE Published 2 days ago

High Risk

This Affects:

isomorphic-git

1.37.0 - 1.38.7

Fixed in 1.38.8

Are you affected? Scan for Free

TL;DR

cherryPick materializes working-tree files through a shared walker helper that does not check whether leading path components are symbolic links, a gap left when the equivalent leading-path check was added only to checkout. A malicious commit can plant a directory symlink and then a child file under it so that applying the commit writes through the symlink to locations outside the working tree. On POSIX hosts using the Node fs provider this allows arbitrary file write and can escalate to remote code execution by targeting files such as ~/.ssh/authorized_keys or .git/hooks. The fix adds a shared leading-path symlink assertion during working-tree materialization so unsafe paths are refused.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses cherryPick on commits from an untrusted repository on a host-backed filesystem.