CVE-2025-64756
1 advisory.
npm/glob CVE-2025-64756: high 7.5, EPSS 3.09%
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Action: Upgrade glob to 10.5.0 or later.
npm i glob@11.1.0npm i glob@10.5.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0 | 11.1.0 | - |
| 10.2.0 | 10.5.0 | - |
Fixed versions
| 11.1.0 | 10.5.0 |
Sources
- osv: GHSA-5j98-mcp5-4vw2
- https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2
- https://nvd.nist.gov/vuln/detail/CVE-2025-64756
- https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f
- https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146
- https://github.com/isaacs/node-glob
CVE-2025-64756 · published · modified · JSON