Detections
Analytics
SCA: security update for isomorphic-git (GHSA-9qw7-j9xw-fv9c)
high Tenable Cloud Security Plugin ID 478832
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6,
isomorphic-git's git.checkout writes new child paths through symlinked leading directory components
without checking them. A malicious repository can first place a directory symlink and later replace the
tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull,
while a single clone can trigger the issue when a symlink already exists or the consuming application
accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the
working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows
usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit
impact to their virtual filesystem and are affected only when they implement symlink creation and
following. This issue is fixed in version 1.38.6. (CVE-2026-63395)
Solution
Update the isomorphic-git library and its related packages to version 1.38.6 or later.See Also
Plugin Details
Severity: High
ID: 478832
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 11/9/2026
Updated: 11/9/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.63
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-63395
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/9/2026
Vulnerability Publication Date: 11/3/2026
Reference Information
CVE: CVE-2026-63395