Introduction
A single malicious filename can compromise an entire CI pipeline or developer workstation if the wrong tool processes it. The glob npm package, a backbone utility for file pattern matching in Node.js, was found to contain a command injection vulnerability in its CLI affecting versions 10.3.7 through 11.0.3. The issue is tracked as CVE-2025-64756. It allows arbitrary command execution when the CLI's -c or --cmd option is used and filenames contain shell metacharacters. Glob has over 79 million weekly downloads and sits inside countless build tools, so this vulnerability has significant implications for the JavaScript ecosystem and for any workflow that automates file handling with glob's CLI.
Technical Information
CVE-2025-64756 is a command injection vulnerability in the glob CLI. The affected functionality is the -c or --cmd option, which runs a shell command for each file that matches a glob pattern. In vulnerable versions (10.3.7 through 11.0.3), the CLI passes matched filenames directly to a shell with shell: true enabled. If a filename contains shell metacharacters such as ;, |, or $(), the shell interprets them instead of treating them as literal characters in the filename. A file named foo.txt; id would make the shell run both the intended command and the injected id command.
The root cause is that the CLI does not escape or sanitize filenames before interpolating them into the shell command string. This is a classic case of CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable code path exists only in the glob CLI. The core JavaScript API does not contain it. The risk is highest where untrusted users or external sources can influence filenames, such as CI/CD pipelines that process user uploads or repositories.
Affected Systems and Versions
- Product: glob npm package
- Affected versions: 10.3.7 through 11.0.3
- Vulnerable configuration: Any use of the CLI with the -c or --cmd option that processes filenames which could contain shell metacharacters
- Not affected: glob versions 11.1.0 and later
Vendor Security History
Glob is maintained by Isaac Z. Schlueter and is a foundational dependency in the Node.js ecosystem. The project has a generally strong security record, with few prior critical vulnerabilities. The vendor patched this issue in version 11.1.0 and publishes security advisories through a public process on GitHub.
