CLEANSTART-2026-LA61588 Picomatch is a glob matcher written JavaScript

CVE-2026-33672 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-JT00262 Picomatch is a glob matcher written JavaScript

CVE-2026-33671 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-SS22483 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the renovate package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-QN85900 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

DEBIAN-CVE-2026-33672

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the POSIXREGEXSOURCE object. Because the object inherits from Object.prototype, specially crafted POSIX bracket expressions e.g., :constructor: ca...