glob CLI: Command injection via -c/--cmd executes matches with shell:true
Priority MEDIUM 40CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 17 fixed, 13 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0309 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial node-glob (isaacs): 10.5.0, 11.1.0glob (npm): 11.1.0, 10.5.0Red Hat: 20 advisoriesRed Hat: 17 fixed, 13 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| isaacs | node-glob | 10.2.0 to before 10.5.0; 11.0.0 to before 11.1.0 | 10.5.0, 11.1.0 | Patch available | CNA |
| — | glob (npm) | 11.0.0 to before 11.1.0 | 11.1.0 | Patch available | GHSA-5j98-mcp5-4vw2 |
| — | glob (npm) | 10.2.0 to before 10.5.0 | 10.5.0 | Patch available | GHSA-5j98-mcp5-4vw2 |
- node-glob Vendorisaacs Affected 10.2.0 to before 10.5.0; 11.0.0 to before 11.1.0 Fixed in 10.5.0, 11.1.0 Patch available CNA
- glob (npm) Vendor— Affected 11.0.0 to before 11.1.0 Fixed in 11.1.0 Patch available GHSA-5j98-mcp5-4vw2
- glob (npm) Vendor— Affected 10.2.0 to before 10.5.0 Fixed in 10.5.0 Patch available GHSA-5j98-mcp5-4vw2
Remediation
- Fix · CNA node-glob (isaacs) Fixed in 10.5.0, 11.1.0
- Fix · GHSA-5j98-mcp5-4vw2 glob (npm) Fixed in 11.1.0 Advisory →
- Fix · GHSA-5j98-mcp5-4vw2 glob (npm) Fixed in 10.5.0 Advisory →
Red Hat 20 advisories
- RHSA-2026:83548 Released 2026-10-15 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:26411 Released 2026-06-16 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9.0 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
- RHSA-2026:19712 Released 2026-05-20 · Red Hat rating CriticalRHOAI 3.3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
Show 17 more Red Hat advisories
- RHSA-2026:15979 Released 2026-05-11 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9
- RHSA-2026:6192 Released 2026-03-30 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.0 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
- RHSA-2026:3713 Released 2026-03-04 · Red Hat rating CriticalRHOAI 3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:2926 Released 2026-02-18 · Red Hat rating ImportantRHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
- RHSA-2026:2925 Released 2026-02-18 · Red Hat rating ImportantRHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/segment-reporting-rhel9
- RHSA-2026:2456 Released 2026-02-10 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.26.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
- RHSA-2026:2144 Released 2026-02-05 · Red Hat rating ImportantRHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7
- RHSA-2026:2139 Released 2026-02-05 · Red Hat rating ImportantRHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
- RHSA-2026:0531 Released 2026-01-13 · Red Hat rating ImportantRed Hat Developer Hub 1.8.2 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2026:0414 Released 2026-01-08 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:0261 Released 2026-01-07 · Red Hat rating ImportantRed Hat Developer Hub 1.7.4 release.
- Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2025:23531 Released 2025-12-17 · Red Hat rating ImportantRHOAI 2.25.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34
- RHSA-2025:22941 Released 2025-12-09 · Red Hat rating ImportantKiali 2.17.2 for Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2025:22938 Released 2025-12-09 · Red Hat rating ImportantKiali 2.11.5 for Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2025:22937 Released 2025-12-09 · Red Hat rating ImportantKiali 2.4.11 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2025:22936 Released 2025-12-09 · Red Hat rating ImportantKiali 1.73.25 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
- RHSA-2025:22905 Released 2025-12-09 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.19.4
- Red Hat OpenShift Pipelines 1.19 registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9, registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| streams for Apache Kafka 3 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:83548 |
| Red Hat Ceph Storage 8.1 | Fixed | RHSA-2026:15979 |
| Red Hat Ceph Storage 9.0 | Fixed | RHSA-2026:26411 |
| Red Hat Developer Hub 1.7 | Fixed | RHSA-2026:0261 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:0531 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:0414 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2025:23531 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:19712, RHSA-2026:3713 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 | Fixed | RHSA-2026:2456 |
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:6192 |
| Red Hat OpenShift Pipelines 1.19 | Fixed | RHSA-2025:22905 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2025:22936 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2025:22937 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2025:22938 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2025:22941 |
| Red Hat Trusted Artifact Signer 1.2 | Fixed | RHSA-2026:2925, RHSA-2026:2926 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:2139, RHSA-2026:2144 |
Not affected: 60 products
- Cryostat 4
- Gatekeeper 3
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Multicluster Global Hub
- Network Observability Operator
- Node HealthCheck Operator
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 7.1
- Red Hat Ceph Storage 8.1
- Red Hat Ceph Storage 9.0
- Red Hat Connectivity Link 1
- Red Hat Data Grid 8
- Red Hat Developer Hub 1.7
- Red Hat Developer Hub 1.8
- Red Hat Directory Server 11
- Red Hat Directory Server 12
- Red Hat Directory Server 13
- Red Hat Discovery 2
- Red Hat Edge Manager preview
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
- Red Hat OpenShift Dev Spaces 3.27
- Red Hat OpenShift GitOps
- Red Hat OpenShift Pipelines 1.19
- Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift distributed tracing 3
- Red Hat Openshift Data Foundation 4
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat Single Sign-On 7
- Red Hat Trusted Artifact Signer
- Red Hat Trusted Artifact Signer 1.2
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Profile Analyzer
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of OptaPlanner 8
- streams for Apache Kafka 2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64756
- 2026-10-03 Alias added: GHSA-5j98-mcp5-4vw2
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
- 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
References
Patch 2
Sources
- CVE-2025-64756 · CVE Program
- CVE-2025-64756 · NVD
- FIRST EPSS
- GHSA-5j98-mcp5-4vw2 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-64756 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences