High · published November 17, 2025
⚡ A crafty filename is all it takes to execute commands on your system! The glob CLI's -c option has a command injection vulnerability that could let an attacker run arbitrary code. 🔥 Think of it like a restaurant that takes orders based on the menu but forgets to check if the ingredients are safe. If a sneaky server slips in a dangerous dish by using a clever name, the whole kitchen could be in chaos! An attacker could exploit this vulnerability to run any command they like, effectively taking control of your system under the privileges of the user or CI account. This could lead to data breaches, service disruptions, or a total compromise of your infrastructure—absolutely devastating!
Think of it like a restaurant that takes orders based on the menu but forgets to check if the ingredients are safe. If a sneaky server slips in a dangerous dish by using a clever name, the whole kitchen could be in chaos! The vulnerability occurs in the glob CLI versions from 10.2.0 to just before 10.5.0 and 11.1.0. When executing a command with the -c/--cmd option, filenames with shell metacharacters are processed by a shell, allowing for command injection attacks.
An attacker could exploit this vulnerability to run any command they like, effectively taking control of your system under the privileges of the user or CI account. This could lead to data breaches, service disruptions, or a total compromise of your infrastructure—absolutely devastating! Upgrade your glob CLI to version 10.5.0 or 11.1.0 as soon as possible. Additionally, review your usage of the -c option to ensure that it's being used securely. Don't forget to audit any scripts that may have relied on vulnerable versions! You've got this! Address this issue today and keep your system safe from crafty attackers! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| isaacs/glob | ≥ 10.2.0, < 10.5.0 | 10.5.0 |
| isaacs/glob | ≥ 11.0.0, < 11.1.0 | 11.1.0 |