PT-2026-28173 · Picomatch · Picomatch

Byamb4 · Published 2026-03-25 · Updated 2026-04-08 · CVE-2026-33672

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Picomatch versions prior to 4.0.4 Picomatch versions prior to 3.0.2 Picomatch versions prior to 2.3.2

Description Picomatch, a JavaScript glob matcher, contains a flaw where specially crafted POSIX bracket expressions, such as [[:constructor:]], can inject inherited method names into generated regular expressions due to the POSIX REGEX SOURCE object inheriting from Object.prototype. This results in incorrect glob matching, potentially causing security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. The issue does not allow for remote code execution. The vulnerability affects users of affected picomatch versions processing untrusted or user-controlled glob patterns.

Recommendations Versions prior to 4.0.4 should be upgraded to version 4.0.4 or later. Versions prior to 3.0.2 should be upgraded to version 3.0.2 or later. Versions prior to 2.3.2 should be upgraded to version 2.3.2 or later. If upgrading is not immediately possible, avoid passing untrusted glob patterns to Picomatch. Sanitize or reject untrusted glob patterns, especially those containing POSIX character classes like [[:...:]]. Avoid using POSIX bracket expressions if user input is involved. Manually patch the library by modifying POSIX REGEX SOURCE to use a null prototype.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-33672

GHSA-3V7F-55P6-F55P

Affected Products

Picomatch

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33672.json · Exploit
• https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p · Vendor Advisory
• https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903 · Patch
• https://ubuntu.com/security/CVE-2026-33672 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33672 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33672 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33672 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-33672 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33672 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33672 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33672 · Vendor Advisory
• https://github.com/micromatch/picomatch · Note
• https://twitter.com/LambdaWatchdog/status/2038949663852642500 · Twitter Post
• https://twitter.com/CVEnew/status/2037513426772062230 · Twitter Post