PT-2021-11537 · Npm+6 · Glob-Parent+6

Yeting Li · Published 2021-01-12 · Updated 2026-02-17 · CVE-2020-28469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: glob-parent versions prior to 5.1.2

Description: The issue is related to the enclosure regex used to check for strings ending in enclosure containing path separator.

Recommendations: For versions prior to 5.1.2, update to version 5.1.2 or later to resolve the issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2021:5171

ALSA-2022:0350

ALSA-2022:6595

AZL-44118

AZL-44862

BIT-GULP-2020-28469

CESA-2021_5171

CESA-2022_0350

CVE-2020-28469

GHSA-WW39-953V-WCQ6

RHSA-2021:2865

RHSA-2021:3280

RHSA-2021:3281

RHSA-2021:4626

RHSA-2021:5171

RHSA-2021_5171

RHSA-2022:0246

RHSA-2022:0350

RHSA-2022:6595

RHSA-2022_0350

RHSA-2022_6595

RLSA-2021:5171

RLSA-2022:0350

RLSA-2022:6595

SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093

SNYK-JAVA-ORGWEBJARSNPM-1059092

SNYK-JS-GLOBPARENT-1016905

Affected Products

Almalinux

Astra Linux

Centos

Confluence

Red Hat

Rocky Linux

Glob-Parent

References · 83

• 🔥 https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093 · Exploit
• https://github.com/gulpjs/glob-parent/pull/36 · Patch
• https://errata.almalinux.org/9/ALSA-2022-6595.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-6595.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-28469 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44862 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:6595 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0350.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:5171 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469 · Security Note
• https://errata.almalinux.org/8/ALSA-2022-0350.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:0350 · Vendor Advisory