GHSA-5j98-mcp5-4vw2
High · 7.5CVSS
7.5
EPSS
—
Published
Nov 17, 2025
CISA due date
—
The record
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | glob | 10.2.0 | 10.5.0 |
| npm | glob | 11.0.0 | 11.1.0 |
| Chainguard | actions-runner | 0 | 2.331.0-r0 |
| Chainguard | actions-runner-compat | 0 | 2.330.0-r0 |
| Chainguard | graalvm-23 | 0 | 0 |
| Chainguard | graalvm-23-ce | 0 | 0 |
| Chainguard | graalvm-23-ce-dbg | 0 | 0 |
| Chainguard | graalvm-23-ce-default-jdk | 0 | 0 |
| Chainguard | graalvm-23-ce-jmods | 0 | 0 |
| Chainguard | graalvm-23-ce-nodejs | 0 | 0 |
| Chainguard | graalvm-23-ce-nodejs-dbg | 0 | 0 |
| Chainguard | graalvm-23-ce-nodejs-default-jdk | 0 | 0 |
| Chainguard | graalvm-23-ce-nodejs-jmods | 0 | 0 |
| Chainguard | graalvm-23-dbg | 0 | 0 |
| Chainguard | graalvm-23-default-jdk | 0 | 0 |
| Chainguard | graalvm-23-graalpy | 0 | 0 |
| Chainguard | graalvm-23-graalpy-venv | 0 | 0 |
| Chainguard | graalvm-23-jmods | 0 | 0 |
| Chainguard | graalvm-23-native-image-dev | 0 | 0 |
| Chainguard | graalvm-23-static | 0 | 0 |
| Chainguard | graalvm-23-truffleruby | 0 | 0 |
| Chainguard | graalvm-24 | 0 | 0 |
| Chainguard | graalvm-24-ce | 0 | 0 |
| Chainguard | graalvm-24-ce-dbg | 0 | 0 |
| Chainguard | graalvm-24-ce-default-jdk | 0 | 0 |
| Chainguard | graalvm-24-ce-jmods | 0 | 0 |
| Chainguard | graalvm-24-ce-nodejs | 0 | 0 |
| Chainguard | graalvm-24-ce-nodejs-dbg | 0 | 0 |
| Chainguard | graalvm-24-ce-nodejs-default-jdk | 0 | 0 |
| Chainguard | graalvm-24-ce-nodejs-jmods | 0 | 0 |
| Chainguard | graalvm-24-graalpy | 0 | 0 |
| Chainguard | graalvm-24-graalpy-venv | 0 | 0 |
| Chainguard | graalvm-24-truffleruby | 0 | 0 |
| Chainguard | graalvm-25 | 0 | 0 |
| Chainguard | graalvm-25-ce | 0 | 0 |
| Chainguard | graalvm-25-ce-dbg | 0 | 0 |
| Chainguard | graalvm-25-ce-default-jdk | 0 | 0 |
| Chainguard | graalvm-25-ce-jmods | 0 | 0 |
| Chainguard | graalvm-25-ce-nodejs | 0 | 0 |
| Chainguard | graalvm-25-ce-nodejs-dbg | 0 | 0 |
| Chainguard | graalvm-25-ce-nodejs-default-jdk | 0 | 0 |
| Chainguard | graalvm-25-ce-nodejs-jmods | 0 | 0 |
| Chainguard | graalvm-25-graalpy | 0 | 0 |
| Chainguard | graalvm-25-graalpy-venv | 0 | 0 |
| Chainguard | graalvm-25-truffleruby | 0 | 0 |
| Chainguard | kibana-8.17 | 0 | 0 |
| Chainguard | kibana-8.17-bitnami | 0 | 0 |
| Chainguard | kibana-8.17-iamguarded | 0 | 0 |
| Chainguard | kibana-8.18 | 0 | 0 |
| Chainguard | kibana-8.18-bitnami | 0 | 0 |
| Chainguard | kibana-8.18-iamguarded | 0 | 0 |
| Chainguard | kibana-8.19 | 0 | 0 |
| Chainguard | kibana-8.19-bitnami | 0 | 0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.9-r0 |
| Chainguard | kibana-9.0 | 0 | 0 |
| Chainguard | kibana-9.0-bitnami | 0 | 0 |
| Chainguard | kibana-9.0-iamguarded | 0 | 0 |
| Chainguard | langfuse | 0 | 0 |
| Chainguard | langfuse-compat | 0 | 0 |
| Chainguard | langfuse-worker | 0 | 0 |
| Chainguard | lerna | 0 | 9.0.1-r1 |
| Chainguard | librechat | 0 | 0 |
| Chainguard | librechat-compat | 0 | 0 |
| Chainguard | librechat-dev | 0 | 0 |
| Chainguard | node-gyp | 0 | 12.2.0-r0 |
| Chainguard | npm | 0 | 11.6.4-r0 |
| Chainguard | npm-10.8.2 | 0 | 0 |
| Chainguard | npm-doc | 0 | 11.6.4-r0 |
| Chainguard | prism | 0 | 5.14.3-r1 |
| Chainguard | pulumi | 0 | 3.209.0-r0 |
| Chainguard | pulumi-language-go | 0 | 3.209.0-r0 |
| Chainguard | pulumi-language-nodejs | 0 | 3.209.0-r0 |
| Chainguard | pulumi-language-python | 0 | 3.209.0-r0 |
| Chainguard | redisinsight | 0 | 0 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 0 |
| Chainguard | renovate | 0 | 42.26.3-r0 |
| Chainguard | sqlpad | 0 | 0 |
| Chainguard | sqlpad-compat | 0 | 0 |
| Chainguard | tileserver-gl | 0 | 0 |
| Chainguard | tileserver-gl-compat | 0 | 0 |
| Chainguard | tileserver-gl-fips | 0 | 0 |
| Chainguard | tileserver-gl-fips-compat | 0 | 0 |
| Chainguard | vitess-20-binaries | 0 | 0 |
| Chainguard | vitess-20-compat | 0 | 0 |
| Chainguard | vitess-21 | 0 | 0 |
| Chainguard | vitess-21-binaries | 0 | 0 |
| Chainguard | vitess-21-compat | 0 | 0 |
| Chainguard | vitess-22 | 0 | 0 |
| Chainguard | vitess-22-binaries | 0 | 0 |
| Chainguard | vitess-22-compat | 0 | 0 |
| Chainguard | vitess-23 | 0 | 0 |
| Chainguard | vitess-23-binaries | 0 | 0 |
| Chainguard | vitess-23-compat | 0 | 0 |
| Wolfi | langfuse | 0 | 0 |
| Wolfi | langfuse-compat | 0 | 0 |
| Wolfi | langfuse-worker | 0 | 0 |
| Wolfi | lerna | 0 | 9.0.1-r1 |
| Wolfi | node-gyp | 0 | 12.2.0-r0 |
| Wolfi | npm | 0 | 11.6.4-r0 |
| Wolfi | npm-doc | 0 | 11.6.4-r0 |
| Wolfi | prism | 0 | 5.14.3-r1 |
| Wolfi | pulumi | 0 | 3.209.0-r0 |
| Wolfi | pulumi-language-go | 0 | 3.209.0-r0 |
| Wolfi | pulumi-language-nodejs | 0 | 3.209.0-r0 |
| Wolfi | pulumi-language-python | 0 | 3.209.0-r0 |
| Wolfi | renovate | 0 | 42.26.3-r0 |
| Wolfi | sqlpad | 0 | 0 |
| Wolfi | sqlpad-compat | 0 | 0 |
| Wolfi | tileserver-gl | 0 | 0 |
| Wolfi | tileserver-gl-compat | 0 | 0 |
| Wolfi | vitess-20-binaries | 0 | 0 |
| Wolfi | vitess-20-compat | 0 | 0 |
| Wolfi | vitess-21 | 0 | 0 |
| Wolfi | vitess-21-binaries | 0 | 0 |
| Wolfi | vitess-21-compat | 0 | 0 |
| Wolfi | vitess-22 | 0 | 0 |
| Wolfi | vitess-22-binaries | 0 | 0 |
| Wolfi | vitess-22-compat | 0 | 0 |
| Wolfi | vitess-23 | 0 | 0 |
| Wolfi | vitess-23-binaries | 0 | 0 |
| Wolfi | vitess-23-compat | 0 | 0 |
Related vulnerabilities
- CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true Same vulnerability
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent… Also affects actions-runner
- GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular… Also affects actions-runner
- CVE-2026-27903 minimatch is a minimal matching utility for converting glob expressions into JavaScript… Also affects actions-runner