glob 10.3.15

Direct Vulnerabilities

Known vulnerabilities in the glob package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `walkCB`, `walkCB2`, `walkCBSync`, and `walkCB2Sync` methods of `src/walker.ts`, where each abort branch calls `cb()` without returning. An attacker can keep a walk consuming filesystem I/O and CPU after it has already been aborted, by driving a traversal that the caller tries to bound, because execution continues past the abort into `processPatterns()`, `readdirCB()`, and recursive `walkCB2()` calls. This affects only callers that rely on the `signal` option or `AbortSignal.timeout()` to cancel a walk, and applies to both `glob()` and `globStream()`. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `glob` to version 13.0.7, 14.0.2 or higher.	>=9.0.0 <13.0.7>=14.0.0 <14.0.2
H Command Injection Affected versions of this package are vulnerable to Command Injection in the CLI, via the `-c/--cmd` option. The processing of commandline options in `src/bin.mts` calls the `foregroundChild()` on them, which defaults to setting `shell: true`. An attacker who can control the filenames being matched can execute arbitrary commands with the privileges of the user running the process by writing files with malicious names containing shell metacharacters - e.g. `$(touch injected_poc)`. The malicious filename must be the target of a match by the `glob -c` command. Such filenames would not trigger this exploit when invoking `glob()` or related functions via the library API. How to fix Command Injection? Upgrade `glob` to version 10.5.0, 11.1.0 or higher.	>=10.3.7 <10.5.0>=11.0.0 <11.1.0

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the walkCB, walkCB2, walkCBSync, and walkCB2Sync methods of src/walker.ts, where each abort branch calls cb() without returning. An attacker can keep a walk consuming filesystem I/O and CPU after it has already been aborted, by driving a traversal that the caller tries to bound, because execution continues past the abort into processPatterns(), readdirCB(), and recursive walkCB2() calls. This affects only callers that rely on the signal option or AbortSignal.timeout() to cancel a walk, and applies to both glob() and globStream().

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade glob to version 13.0.7, 14.0.2 or higher.

>=9.0.0 <13.0.7>=14.0.0 <14.0.2

Command Injection

Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild() on them, which defaults to setting shell: true. An attacker who can control the filenames being matched can execute arbitrary commands with the privileges of the user running the process by writing files with malicious names containing shell metacharacters - e.g. $(touch injected_poc).

The malicious filename must be the target of a match by the glob -c command. Such filenames would not trigger this exploit when invoking glob() or related functions via the library API.

How to fix Command Injection?

Upgrade glob to version 10.5.0, 11.1.0 or higher.

>=10.3.7 <10.5.0>=11.0.0 <11.1.0

glob@10.3.15

the most correct and second fastest glob implementation in JavaScript

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically