Threats tagged 'ghsa-cw2g-2vwq-88w6'

isomorphic-git contains a path traversal vulnerability in its tree parser that allows a malicious repository to write files outside the intended working directory during clone or checkout operations. This occurs because the parser does not reject the reserved name '..' as a tree entry, enabling unbounded directory traversal. Exploitation requires cloning from a non-GitHub remote or a man-in-the-middle attack, as GitHub rejects such trees. Overwriting files outside the working directory can lead to code execution by modifying shell or configuration files. A fix is available in version 1.38.6.