npm/picomatch CVE-2026-33672: medium 5.3, EPSS 0.56%
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Action: Upgrade picomatch to 2.3.2 or later.
npm i picomatch@4.0.4npm i picomatch@3.0.2npm i picomatch@2.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.0.4 | - |
| 3.0.0 | 3.0.2 | - |
| 0 | 2.3.2 | - |
Fixed versions
| 4.0.4 | 3.0.2 | 2.3.2 |
Sources
- osv: GHSA-3v7f-55p6-f55p
- https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p
- https://nvd.nist.gov/vuln/detail/CVE-2026-33672
- https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903
- https://github.com/micromatch/picomatch
CVE-2026-33672 · published · modified · JSON