This injection allows an attacker to redefine global properties used by the library. Specifically, an attacker can redirect network traffic through an arbitrary, attacker-controlled proxy server. When a client application using a vulnerable version of isomorphic-git interacts with the malicious repository, the library may trigger its onAuth callback, causing the leakage of sensitive authentication credentials to the attacker-supplied proxy. This vulnerability presents a high risk for CI/CD environments and developer tools that automate Git interactions with external, potentially untrusted repositories.

Impact

Successful exploitation allows for the interception of authentication credentials used by applications relying on isomorphic-git. This affects any ecosystem or service performing automated Git operations on untrusted remotes, potentially leading to unauthorized access to internal development environments, private repositories, or cloud services.

Recommendation

• Update the isomorphic-git dependency to version 1.42.0 or later across all projects.
• Audit applications for dependencies using isomorphic-git to interact with external or user-provided Git repositories.
• Review CI/CD pipeline configurations to ensure that clones or fetches from untrusted repositories are executed in isolated, ephemeral environments with restricted network access.
• Monitor for abnormal outbound connections originating from build servers or developer machines that execute isomorphic-git operations.