CVE-2025-64756

Published Nov 17, 2025

Last updated 9 months ago

npm

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64756 describes a command injection vulnerability found in the command-line interface (CLI) of the `glob` npm package. This flaw specifically impacts the `-c` or `--cmd` option, which is designed to execute a shell command for each file identified by a glob pattern. The vulnerability arises because, in affected versions, the `glob` CLI passes matched filenames directly to a shell with the `shell: true` option enabled. Consequently, if a filename contains special shell metacharacters such as semicolons (`;`), pipes (`|`), or command substitutions (`$()`), these characters are interpreted as executable commands by the shell rather than being treated as literal parts of the filename. This oversight allows for arbitrary command execution when processing files with maliciously crafted names, particularly in environments where filenames can be influenced by untrusted sources. The issue has been addressed in `glob` versions 10.5.0, 11.1.0, and 12.0.0.

Description: Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.
Source: security-advisories@github.com
NVD status: Analyzed
Products: glob

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 5.9
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:isaacs:glob:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "3C8601DB-5326-473F-8AB9-6F66833AC884",
            "versionEndExcluding": "10.5.0",
            "versionStartIncluding": "10.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:isaacs:glob:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "F7828865-293E-4DB7-AC94-A3C1027E25A1",
            "versionEndExcluding": "11.1.0",
            "versionStartIncluding": "11.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.