CVE-2026-89011 isomorphic-git CVE debrief

Who should care

Defenders responsible for maintaining or securing systems or applications that use isomorphic-git should assess exposure to this vulnerability. This includes developers, security engineers, and IT professionals who manage software dependencies and mitigate potential security risks.

Why it matters

CVE-2026-89011 is a prototype pollution vulnerability in isomorphic-git that allows a malicious Git server operator to reroute network operations through an attacker-controlled proxy, potentially leading to credential transmission and unauthorized access. Defenders should prioritize verifying the version of isomorphic-git in use and upgrading to version 1.42.0 or later to mitigate this vulnerability.

• Credential transmission to an attacker-controlled proxy.
• Potential for unauthorized access to sensitive information.
• Need for verification of isomorphic-git version in use.
• Possible disruption of network operations through attacker-controlled proxy.

Technical summary

The getRemoteInfo function in isomorphic-git before version 1.42.0 is vulnerable to prototype pollution. A malicious Git server operator can advertise crafted ref names containing '__proto__' path segments during ref negotiation, allowing them to pollute Object.prototype. This can cause isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.

Defensive priority

Defenders should prioritize verifying the version of isomorphic-git in use and upgrading to version 1.42.0 or later to mitigate this vulnerability. Additionally, defenders should assess exposure by identifying systems or applications that use isomorphic-git and are potentially vulnerable to credential transmission to an attacker-controlled proxy.

Recommended defensive actions

• Verify the version of isomorphic-git in use and upgrade to version 1.42.0 or later.
• Identify systems or applications that use isomorphic-git and assess their exposure to this vulnerability.
• Monitor for potential credential transmission to an attacker-controlled proxy.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source material. However, the corpus does not establish versions, exploitation, impact, or remediation beyond upgrading to version 1.42.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.