CVE-2025-64756: glob CLI: Command injection via -c/--cmd executes matches with shell:true

High severity · published Nov 17, 2025

CVE-2025-64756

glob CLI: Command injection via -c/--cmd executes matches with shell:true

7.5

CVSS

3.1%

EPSS

On KEV

Description

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.1% · higher than 88% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

node-glob · isaacs

>= 10.2.0, < 10.5.0; >= 11.0.0, < 11.1.0 · source: vendor

Glob · Isaacs

10.2.0 before 10.5.0; 11.0.0 before 11.1.0 · source: NVD

In the news

VulnerabilityCritical

Siemens SIDIS Prime

View CSAF Summary SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version. The following versions of Siemens SIDIS Prime are affected: SIDIS Prime vers:intdot/<4.0.800 (CVE-2024-29857, CVE-2024-30171, CVE-2024-30172, CVE-2024-41996, CVE-2025-6965, CVE-2025-7783, CVE-2025-9230, CVE-2025-9232, CVE-2025-9670, CVE-2025-12816, CVE-2025-15284, CVE-2025-58751, CVE-2025-58752, CVE-2025-58754, CVE-2025-62522, CVE-2025-64718, CVE-2025-64756, CVE-2025-66030, CVE-2025-66031, CVE-2025-66035, CVE-2025-66412, CVE-2025-69277, CVE-2026-22610) CVSS Vendor Equipment Vulnerabilities v3 8.7 Siemens Siemens SIDIS Prime Out-of-bounds Read, Observable Discrepancy, Improper Input Validation, Improper Certificate Validation, Numeric Truncation Error, Use of Insufficiently Random Values, Out-of-bounds Write, Inefficient Regular Expression Complexity, Interpretation Conflict, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Relative Path Traversal, Allocation of Resources Without Limits or Throttling, Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Integer Overflow or Wraparound, Uncontrolled Recursio...

CVE-2024-29857 CVE-2024-30171 CVE-2024-30172

Mar 12, 2026·CISA Advisories

Affected product

node-glob

isaacs

All node-glob CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-64756

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-64756

Patch

https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f

Patch

https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146

Exploit

https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2