2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
glob
Ecosystem: npm
Downloads: 1.76 Bln
- 0CriticalAffects 0 versions
- 1HighAffects 2 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting glob, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3g3m-2fjr-6pw4 | Moderate | Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb() without returning. As a result, callers that rely on signal or AbortSignal.timeout() to bound glob traversal cost can still incur filesystem I/O and CPU work after the request has already been rejected. ### Details This was reproduced on glob v13.0.6 (commit e80cb38ae60d6cbff9e75f39032a994858994d35). The README documents that the signal option cancels the glob walk. However, in src/walk |
| GitHub (opens in a new tab) | |
| GHSA-5j98-mcp5-4vw2 | High | glob CLI: Command injection via -c/--cmd executes matches with shell:true### Summary The glob CLI contains a command injection vulnerability in its `-c/--cmd` option that allows arbitrary command execution when processing files with malicious names. When `glob -c <command> <patterns>` is used, matched filenames are passed to a shell with `shell: true`, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. ### Details **Root Cause:** The vulnerability exists in `src/bin.mts:277` where the CLI collects glob matches and executes the supplied command using `foregroundChil |
| GitHub (opens in a new tab) |
- GHSA-3g3m-2fjr-6pw4ModerateGlob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
>= 9.0.0, < 14.0.2
### Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb() without returning. As a result, callers that rely on signal or AbortSignal.timeout() to bound glob traversal cost can still incur filesystem I/O and CPU work after the request has already been rejected. ### Details This was reproduced on glob v13.0.6 (commit e80cb38ae60d6cbff9e75f39032a994858994d35). The README documents that the signal option cancels the glob walk. However, in src/walk
CVE: CVE-2026-118773
- GHSA-5j98-mcp5-4vw2Highglob CLI: Command injection via -c/--cmd executes matches with shell:true
>= 11.0.0, < 11.1.0>= 10.2.0, < 10.5.0
### Summary The glob CLI contains a command injection vulnerability in its `-c/--cmd` option that allows arbitrary command execution when processing files with malicious names. When `glob -c <command> <patterns>` is used, matched filenames are passed to a shell with `shell: true`, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. ### Details **Root Cause:** The vulnerability exists in `src/bin.mts:277` where the CLI collects glob matches and executes the supplied command using `foregroundChil
CVE: CVE-2025-64756