https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:49:10 +0000 https://vulnerability.circl.lu/vuln/ghsa-5j98-mcp5-4vw2 <p><strong>Affected:</strong> npm: glob</p> <p>### Summary</p> <p>The glob CLI contains a command injection vulnerability in its `-c/--cmd` option that allows arbitrary command execution when processing files with malicious names. When `glob -c &lt;command&gt; &lt;patterns&gt;` is used, matched filenames are passed to a shell with `shell: true`, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges.</p> <p>### Details</p> <p>**Root Cause:** The vulnerability exists in `src/bin.mts:277` where the CLI collects glob matches and executes the supplied command using `foregroundChild()` with `shell: true`:</p> <p>```javascript stream.on(&#39;end&#39;, () =&gt; foregroundChild(cmd, matches, { shell: true })) ```</p> <p>**Technical Flow:** 1. User runs `glob -c &lt;command&gt; &lt;pattern&gt;` 2. CLI finds files matching the pattern 3. Matched filenames are collected into an array 4. Command is executed with matched filenames as arguments using `shell: true` 5. Shell interprets metacharacters in filenames as command syntax 6. Malicious filenames execute arbitrary commands</p> <p>**Affected Component:** - **CLI Only:** The vulnerability affects only the command-line interface - **Library Safe:** The core glob library API (`glob()`, `globSync()`, streams/iterators) is not affected - **Shell Dependency:** Exploitation requires shell metacharacter support (primarily POSIX systems)</p> <p>**Attack Surface:** - Files with names containing shell metacharacters: `$()`, backticks, `;`, `&amp;`, `|`, etc. - Any directory whe…</p> <p><strong>Affected:</strong> npm: glob</p> <p>### Summary</p> <p>The glob CLI contains a command injection vulnerability in its `-c/--cmd` option that allows arbitrary command execution when processing files with malicious names. When `glob -c &lt;command&gt; &lt;patterns&gt;` is used, matched filenames are passed to a shell with `shell: true`, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges.</p> <p>### Details</p> <p>**Root Cause:** The vulnerability exists in `src/bin.mts:277` where the CLI collects glob matches and executes the supplied command using `foregroundChild()` with `shell: true`:</p> <p>```javascript stream.on(&#39;end&#39;, () =&gt; foregroundChild(cmd, matches, { shell: true })) ```</p> <p>**Technical Flow:** 1. User runs `glob -c &lt;command&gt; &lt;pattern&gt;` 2. CLI finds files matching the pattern 3. Matched filenames are collected into an array 4. Command is executed with matched filenames as arguments using `shell: true` 5. Shell interprets metacharacters in filenames as command syntax 6. Malicious filenames execute arbitrary commands</p> <p>**Affected Component:** - **CLI Only:** The vulnerability affects only the command-line interface - **Library Safe:** The core glob library API (`glob()`, `globSync()`, streams/iterators) is not affected - **Shell Dependency:** Exploitation requires shell metacharacter support (primarily POSIX systems)</p> <p>**Attack Surface:** - Files with names containing shell metacharacters: `$()`, backticks, `;`, `&amp;`, `|`, etc. - Any directory whe…</p> https://vulnerability.circl.lu/vuln/ghsa-5j98-mcp5-4vw2