PT-2025-47185

🗓️ 17 Nov 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com

Glob CLI -c option allows code execution from malicious filenames; update to 11.1.0 or later.

Reporter	Title	Published	Views	Family All 102
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	30 Jan 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	16 Feb 202609:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Processing is vulnerable to command injection vulnerability (CVE-2025-64756)	11 Feb 202611:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules (CVE-2025-64718, CVE-2025-64756, CVE-2025-13466 & CVE-2025-65945)	22 Dec 202511:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	17 Feb 202612:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software	14 Jan 202612:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	7 Apr 202607:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Endpoint Management is vulnerable to command injection vulnerability (CVE-2025-64756)	10 Feb 202606:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	22 Jan 202605:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	31 Mar 202612:18	–	ibm

Source	Link
twitter	www.twitter.com/VulmonFeeds/status/1990493078168174721
github	www.github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2
osv	www.osv.dev/vulnerability/GHSA-5j98-mcp5-4vw2
twitter	www.twitter.com/ZeroPathLabs/status/1990490065177288870
github	www.github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f
reddit	www.reddit.com/r/VulnMatter/comments/1p0kjng/resumen_diario_de_vulnerabilidades_18112025
github	www.github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146
osv	www.osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-64756
bdu	www.bdu.fstec.ru/vul/2026-01716
docs	www.docs.bell-sw.com/security/cves/CVE-2025-64756

01 Mar 2026 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 3.17.5

EPSS0.00025

SSVC

glob tool command injection c option arbitrary code execution malicious filenames version update 11.1.0