PT-2025-47185 · Glob · Glob

Published

2025-11-17

·

Updated

2025-12-07

·

CVE-2025-64756

CVSS v3.1
7.5
VectorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Glob versions 10.3.7 through 11.0.3
Description The glob command-line interface contains a command injection issue in its -c/--cmd option. This allows arbitrary command execution when processing files with maliciously crafted names. When using 
glob -c <command> <patterns>
, matched filenames are passed to a shell, and shell metacharacters within filenames can trigger command injection, leading to arbitrary code execution with the privileges of the user or CI account. The 
cmd
option is vulnerable.
Recommendations Update to version 11.1.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-64756
GHSA-5J98-MCP5-4VW2

Affected Products

Glob