CVE-2025-64756: 
JavaScript vulnerability analysis and mitigation

CVE-2025-64756 affects the glob CLI tool versions 10.3.7 through 11.0.3, containing a command injection vulnerability in its -c/--cmd option. The vulnerability was discovered and disclosed on November 17, 2025, affecting the command-line interface component of the node-glob package. When glob -c is used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges (GitHub Advisory).

The vulnerability exists in src/bin.mts where the CLI collects glob matches and executes the supplied command using foregroundChild() with shell: true. The core glob library API (glob(), globSync(), streams/iterators) is not affected. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (GitHub Advisory).

The vulnerability allows arbitrary command execution with full privileges of the user running the glob CLI, with no privilege escalation required. Attackers can potentially access environment variables, file system, and network. This poses significant risks in CI/CD pipelines, developer workstations, automated processing systems, and could enable supply chain poisoning. The impact is particularly severe on POSIX/Linux/macOS systems due to flexible filename characters and shell parsing (GitHub Advisory).

The vulnerability has been patched in versions 10.5.0, 11.1.0, and 12.0.0. Users should upgrade to glob@11.1.0 or higher immediately. For cases where glob CLI actions fail, commands containing positional arguments should be converted to use the --cmd-arg/-g option instead. As a last resort, --shell can be used to maintain shell:true behavior until glob v12, but only in environments where no untrusted contents can be encountered in the file path results (GitHub Advisory, GitHub Commit).