CVE-2026-33672: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33672 is a method injection vulnerability in picomatch, a JavaScript glob matcher, affecting the POSIX_REGEX_SOURCE object. Because this object inherits from Object.prototype, specially crafted POSIX bracket expressions (e.g., [[:constructor:]]) can reference inherited method names, which are then injected into generated regular expressions, causing incorrect glob matching behavior. Affected versions include picomatch < 2.3.2, 3.0.0–3.0.1, and 4.0.0–4.0.3 for Node.js. The vulnerability was published on March 23, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory). Downstream products from IBM and Microsoft are also affected (IBM Advisory, Microsoft MSRC).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes / Prototype Pollution). The POSIX_REGEX_SOURCE object in picomatch's lib/constants.js was defined without a null prototype, meaning it inherits properties from Object.prototype such as constructor, toString, and __proto__. When a user-controlled POSIX bracket expression like [[:constructor:]] is processed, picomatch looks up the class name in POSIX_REGEX_SOURCE and retrieves the inherited constructor function, which is then coerced to a string and injected into the compiled regular expression. The fix, applied in commit 4516eb5, adds __proto__: null to the POSIX_REGEX_SOURCE object literal, severing the prototype chain (GitHub Commit, GitHub Advisory).

Exploitation causes incorrect glob matching behavior, where patterns may match unintended filenames or fail to match expected ones — an integrity impact with no confidentiality or availability loss. Applications that rely on picomatch for security-sensitive operations such as file access filtering, input validation, or access control are most at risk, as attackers could craft glob patterns that bypass these controls. Remote code execution is explicitly not possible through this vulnerability, but security-relevant logic errors could enable unauthorized file access or filter bypass in affected applications (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). No threat actor attribution has been identified. The EPSS score is approximately 0.059% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to supply untrusted or user-controlled glob patterns to an application using a vulnerable picomatch version.

1. Identify a target application: Find a Node.js application that uses a vulnerable version of picomatch (< 2.3.2, 3.0.0–3.0.1, or 4.0.0–4.0.3) and accepts user-controlled glob patterns for file filtering, validation, or access control.
2. Craft a malicious POSIX bracket expression: Construct a glob pattern using a POSIX character class that references an Object.prototype property, such as [[:constructor:]] or [[:toString:]].
3. Submit the pattern: Pass the crafted glob pattern to the application's glob-matching interface (e.g., via an API parameter, file upload filter, or search field that feeds into picomatch).
4. Observe incorrect matching: The injected method string (e.g., the string representation of Function.prototype.constructor) is embedded into the compiled regex, causing the pattern to match unintended filenames or bypass intended filters.
5. Leverage the bypass: Use the incorrect match result to access files that should have been excluded, bypass security filters, or circumvent access control logic that depends on glob pattern evaluation (GitHub Advisory, GitHub Commit).

• Logs: Application logs showing glob pattern inputs containing POSIX bracket expressions with unexpected class names such as [[:constructor:]], [[:toString:]], or [[:__proto__:]].
• Application Behavior: Unexpected file matches or access control decisions where files outside the intended scope are matched by glob patterns; anomalous results from file filtering or validation logic.
• Input Data: User-supplied input fields or API parameters containing patterns matching the regex \[\[:[a-zA-Z_$][a-zA-Z0-9_$]*:\]\] that do not correspond to standard POSIX character classes (e.g., alnum, alpha, digit, space).

Upgrade picomatch to version 2.3.2, 3.0.2, or 4.0.4 (or later), depending on the release line in use (GitHub Advisory). If an immediate upgrade is not possible, avoid passing untrusted or user-controlled glob patterns to picomatch. Additional workarounds include sanitizing or rejecting inputs containing POSIX character classes ([[:...]]), avoiding POSIX bracket expressions when user input is involved, and manually patching lib/constants.js by adding __proto__: null as the first property of the POSIX_REGEX_SOURCE object (GitHub Commit). IBM has issued advisories for multiple affected products including Watsonx BI Assistant, Application Modernization Accelerator, Process Mining, Guardium Data Security Center, and others, and users of those products should apply the relevant IBM interim fixes (IBM Advisory).

The vulnerability was discovered by researcher ByamB4 and remediated by danez and doowb from the picomatch maintainer team (GitHub Advisory). IBM issued multiple security bulletins across its product portfolio acknowledging the dependency on vulnerable picomatch versions, reflecting the broad reach of this supply chain issue. Microsoft also acknowledged the vulnerability in its Security Response Center for affected Azure Linux Node.js packages (Microsoft MSRC). No significant broader media coverage or notable community controversy has been identified.