CVE-2026-63395
Description
A flaw was found in isomorphic-git. This vulnerability allows a remote attacker to achieve arbitrary code execution by tricking a user or automated process into checking out a specially crafted repository. During the checkout operation, the library writes files through directory symbolic links without proper validation, enabling arbitrary files to be written outside the intended working directory on the host system.
Statement
This vulnerability is rated as Important because successful exploitation enables arbitrary file writes on the host filesystem, potentially leading to remote code execution in the context of the service. In Red Hat environments such as Red Hat Developer Hub and Ansible Automation Platform, exposure occurs when automated workflows or services checkout untrusted Git repositories. Tasks and pipelines restricted exclusively to trusted, internally maintained repositories are not susceptible to this attack vector.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate destination file paths and prevent writing through symlinked leading directory components during isomorphic-git checkout operations: upgrade to isomorphic-git 1.38.6+ (or the corresponding fixed Red Hat builds), which inspect leading path components using lstat and reject file writes or directory creations with UnsafeFilepathError if a symlink is encountered, closing all 2 injection vectors (crafted repository checkout creating a directory symlink followed by child file writes, git pull updating tree entries under a previously checked-out symlinked directory). Until patched, this is only a concern on Linux and macOS environments running Node.js services or tools checking out untrusted Git repositories — Windows environments without symlink privileges, and browser or in-memory virtual filesystems are unaffected — so Restrict automated checkout or pull operations on untrusted Git repositories, and prevent automated workflows from processing untrusted repositories in environments where symlink creation is permitted. As a compensating measure, Log file system modifications and symlink creations during checkout operations using auditd, Confine the Node.js process with SELinux in enforcing mode to prevent unauthorized host file modifications, Restrict filesystem write privileges for the checkout process to the repository working tree using Landlock, Isolate the filesystem view via mount namespaces to prevent directory symlink traversal from escaping into the host filesystem, Detect anomalous file writes outside the working tree or subsequent execution of dropped payloads with an EDR agent, and Detect unexpected file write events outside allowed working directories and anomalous spawned child processes using Falco or eBPF runtime security. These controls limit blast radius and contain exploitation, but they do not fix the underlying directory symlink traversal defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
