glob vulnerabilities
CVEs whose affected-version data names the glob package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-118773MediumGlob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
▾ Sunlitglob · globEPSS 0.35%via GHSA
CVE-2025-64756High· 7.5Glob matches files using patterns the shell uses
Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution …
▾ Twilightisaacs · globEPSS 3.1%via NVD