PT-2025-47185 · Glob+1 · Glob+1

Published 2025-11-17 · Updated 2026-05-18 · CVE-2025-64756

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Glob versions 10.3.7 through 11.0.3

Description The glob command-line interface contains a command injection issue in its -c/--cmd option. This allows arbitrary command execution when processing files with maliciously crafted names. When using glob -c <command> <patterns>, matched filenames are passed to a shell, and shell metacharacters within filenames can trigger command injection, leading to arbitrary code execution with the privileges of the user or CI account. The cmd option is vulnerable.

Recommendations Update to version 11.1.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-01716

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-NB51079

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CVE-2025-64756

ECHO-840F-D5CE-2603

GHSA-5J98-MCP5-4VW2

OPENSUSE-SU-2025:15775-1

Affected Products

Confluence

Glob

References · 155

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64756.json · Exploit
• https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2 · Vendor Advisory
• https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f · Patch
• https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1528 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24842 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-64756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26278 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1527 · Security Note