Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb() without returning. As a result, callers that rely on signal or AbortSignal.timeout() to bound glob traversal cost can still incur filesystem I/O and CPU work after the request has already been rejected. Details This was reproduced on glob v13.0.6 (commit e80cb38ae60d6cbff9e75f39032a994858994d35). The README documents that the signal option cancels the glob walk. However, in src/walker.ts, the following methods call cb() when this.signal?.aborted is true but do not return: - GlobUtil.walkCB() - GlobUtil.walkCB2() - GlobUtil.walkCBSync() - GlobUtil.walkCB2Sync() Example vulnerable pattern: if (this.signal?.aborted) cb() Because execution continues after cb(), the walker still reaches processor.processPatterns(), readdirCB(), and recursive walkCB2() calls. The issue was directly…
Recommended action: Upgrade to 14.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command <patterns is used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. Details Root Cause: The vulnerability exists in src/bin.mts:277 where the CLI collects glob matches and executes the supplied command using foregroundChild() with shell: true: Technical Flow: 1. User runs glob -c <command <pattern 2. CLI finds files matching the pattern 3. Matched filenames are collected into an array 4. Command is executed with matched filenames as arguments using shell: true 5. Shell interprets metacharacters in filenames as command syntax 6. Malicious filenames execute arbitrary commands Affected Component: - CLI Only: The vulnerability affects only…
Recommended action: Upgrade to 11.1.0 or 10.5.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.