CVE-2026-89011

isomorphic-git versions before 1.42.0 contain an Object prototype pollution flaw (CWE-1321) in the getRemoteInfo function, which clients use to query a Git server's advertised capabilities. A Git server operator controlling the URL passed to getRemoteInfo can advertise a crafted ref name containing '__proto__' path segments (such as '__proto__/corsProxy') during ref negotiation, polluting Object.prototype in the client process. The pollution allows the attacker to reroute all of the victim's subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker. Any application, service, or tool built with isomorphic-git before 1.42.0 that queries untrusted or attacker-supplied Git URLs is affected, while deployments that only talk to trusted, first-party Git servers face little practical risk. The flaw carries a CVSS 4.0 score of 7.1 (high) with user interaction required, is not listed in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

What to do: Upgrade to isomorphic-git 1.42.0 or later, which fixes the prototype pollution in getRemoteInfo. Until patched, restrict getRemoteInfo calls to trusted Git server URLs and audit npm/bundler lockfiles and dependency trees for vulnerable isomorphic-git versions. Treat credentials supplied via onAuth to untrusted Git servers as potentially compromised and rotate them if exposure is suspected.