Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-89011isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

High 7.1

In plain English

A high-severity prototype pollution in isomorphic-git from isomorphic-git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 61.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.

Affected products (as reported)

Vendor	Product	Versions
isomorphic-git	isomorphic-git	0 – before 1.42.0

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-83vg-jxvh-fx76) vendor-advisory
Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/isomorphic-git-prototype-pollution-via-getremoteinfo third-party-advisory