Threats tagged 'ghsa-9qw7-j9xw-fv9c'

isomorphic-git versions prior to 1.38.6 contain a vulnerability in the checkout process where directory symlinks are not properly checked before writing files. This allows a malicious repository to write files outside the intended working directory by exploiting directory symlinks, potentially leading to arbitrary file writes on the host system. The impact varies by filesystem provider, with the highest risk on POSIX systems using Node's fs module, where remote code execution (RCE) is possible by injecting attacker-controlled files such as SSH authorized keys or Git hooks. The issue is fixed in version 1.38.6.