CVE-2026-118773: isaacs node-glob: Glob matches files using patterns the shell uses

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB, GlobUtil.walkCB2, GlobUtil.walkCBSync, and GlobUtil.walkCB2Sync, invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout rejects or emits...

Astra Linux – Vulnerability in node-glob-parent

This affects the glob-parent package before version 5.1.2. The enclosure regex used to check for strings ending with an enclosure containing a path separator is affected...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild on them, which defaults to setting shell: true. An attacker who can control the filenames being matche...