Skip to content
OpenAdvisories

Package · npm

glob

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.3
    CVE-2026-118773

    Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

    Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After Abort…

    isaacs node-glob glob node-glob Debian Ubuntu npm
  • High 7.5
    CVE-2025-64756

    glob CLI: Command injection via -c/--cmd executes matches with shell:true

    Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files …

    isaacs node-glob npm glob Alpine npm