isomorphic-git vulnerabilities

CVEs whose affected-version data names the isomorphic-git package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-89011High· 7.1

1w ago

isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path …

▾ Twilightisomorphic-git · isomorphic-gitEPSS 0.26%via CVEORG