Came across something in yarn.lock around line 4963 that looked worth flagging.
The project is using glob 10.4.5, which contains a command‑injection flaw in its CLI “-c/--cmd” option. When glob is invoked with -c, matched filenames are passed to a shell with shell:true, allowing malicious filenames to execute arbitrary commands under the same user (or CI) privileges. This is a HIGH‑severity issue because an attacker can craft a filename that triggers code execution, leading to full compromise of the build environment. The vulnerability is fixed in glob 10.5.0 and later, so the affected version must be upgraded and any usage of the -c option avoided or replaced with a safer API.
Something like this might fix it:
*** Begin Patch
*** Update File: yarn.lock
@@
-"glob@10.4.5":
- version "10.4.5"
- resolved "https://registry.yarnpkg.com/glob/-/glob-10.4.5.tgz"
- integrity sha512-OLDHASH==
- dependencies:
- ...
+"glob@10.5.0":
+ version "10.5.0"
+ resolved "https://registry.yarnpkg.com/glob/-/glob-10.5.0.tgz"
+ integrity sha512-NEWHASH==
+ dependencies:
+ ...
*** End Patch
***
*** Begin Patch (package.json)
@@
- "glob": "10.4.5",
+ "glob": "^10.5.0",
*** End Patch
***
*** Begin Patch (code usage example)
@@
-// Vulnerable usage: executes a command for every matched file
-const { execSync } = require('child_process');
-glob('-c', 'rm -rf {{}}', '**/*.txt');
+// Secure usage: avoid the CLI -c option and run commands explicitly in Node
+const { execSync } = require('child_process');
+const glob = require('glob');
+glob('**/*.txt', (err, files) => {
+ if (err) throw err;
+ files.forEach((file) => {
+ // Execute command with the filename as an argument, without spawning a shell
+ execSync('rm -rf', { stdio: 'inherit', argv0: file, shell: false });
+ });
+});
*** End Patch
*** End Patch
For reference: rule CVE-2025-64756. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
yarn.lockaround line 4963 that looked worth flagging.The project is using glob 10.4.5, which contains a command‑injection flaw in its CLI “-c/--cmd” option. When glob is invoked with -c, matched filenames are passed to a shell with shell:true, allowing malicious filenames to execute arbitrary commands under the same user (or CI) privileges. This is a HIGH‑severity issue because an attacker can craft a filename that triggers code execution, leading to full compromise of the build environment. The vulnerability is fixed in glob 10.5.0 and later, so the affected version must be upgraded and any usage of the -c option avoided or replaced with a safer API.
Something like this might fix it:
For reference: rule
CVE-2025-64756. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.