A flaw in the getRemoteInfo function of isomorphic‑git before version 1.42.0 permits names that contain __proto__ path segments during ref negotiation. This causes the library to modify Object.prototype, which can reconfigure the onAuth callback. If an attacker supplies a URL, the library will route subsequent network operations through an attacker‑controlled proxy and transmit credentials to the attacker. The vulnerability does not provide a direct code execution path but can lead to the unintended disclosure of authentication tokens and other sensitive information. The weakness is identified as a prototype pollution flaw. Based on the description, it is inferred that the attacker can manipulate network traffic by configuring the onAuth callback to redirect to a malicious proxy.

The vulnerability affects all releases of the isomorphic‑git repository named isomorphic‑git prior to the 1.42.0 tag. Users running the client logic in any JavaScript or Node.js application that imports this library without updating beyond 1.42.0 are impacted. No additional vendor or product variations exist beyond the primary isomorphic‑git package.

The CVSS score of 7.1 indicates a high‑severity condition. While the EPSS score is not available, the flaw can be exploited by any party that can control or influence a Git server’s advertised references, such as a malicious hosting provider or a compromised upstream repository. Based on the description, it is inferred that the attacker would supply a specially crafted ref like "__proto__/corsProxy" during negotiation. The vulnerability does not require additional privileges or local access, making it a network‑based threat. It is not listed in the CISA KEV catalog, but the potential for credential theft warrants timely remediation.