The vulnerability lies in the tree parser of isomorphic-git, which incorrectly accepts a ".." entry that is not surrounded by path separators. This flaw allows an attacker to write files outside the intended working directory during a clone or checkout operation. The ability to write arbitrary files could enable overwriting startup or configuration files, leading to execution of attacker‑controlled code. The weakness is classified as Path Traversal (CWE‑22).

isomorphic-git is affected in all versions prior to 1.38.6. The library can be used in Node.js and browser environments, so any deployment that performs clone or checkout from a non‑trusted remote may be impacted. Version 1.38.6 and later contain the fix.

The CVSS score of 5.3 indicates a moderate severity. Since EPSS information is not available, the likelihood of exploitation is not quantified, but the problem can be triggered by any remote from which a user clones or checks out a repository. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a repository that contains a malicious tree entry; it can be performed by a man‑in‑the‑middle or by a malicious remote hosting provider. Successful exploitation would allow the attacker to write files to the host’s filesystem and potentially achieve arbitrary code execution.