https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 01:35:29 +0000 https://db.gcve.eu/vuln/ghsa-3v7f-55p6-f55p <p><strong>Affected:</strong> npm: picomatch</p> <p>### Impact picomatch is vulnerable to a **method injection vulnerability (CWE-1321)** affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression.</p> <p>This leads to **incorrect glob matching behavior (integrity impact)**, where patterns may match unintended filenames. The issue does **not enable remote code execution**, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control.</p> <p>All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted.</p> <p>### Patches</p> <p>This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.</p> <p>Users should upgrade to one of these versions or later, depending on their supported release line.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.</p> <p>Possible mitigations include: - Sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`. - Avoiding the use of POSIX bracket expressions if user input is involved. - Manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype:</p> <p>```js const POSIX_REGEX_SOURCE = { __proto__: null, alnu…</p> <p><strong>Affected:</strong> npm: picomatch</p> <p>### Impact picomatch is vulnerable to a **method injection vulnerability (CWE-1321)** affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression.</p> <p>This leads to **incorrect glob matching behavior (integrity impact)**, where patterns may match unintended filenames. The issue does **not enable remote code execution**, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control.</p> <p>All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted.</p> <p>### Patches</p> <p>This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.</p> <p>Users should upgrade to one of these versions or later, depending on their supported release line.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.</p> <p>Possible mitigations include: - Sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`. - Avoiding the use of POSIX bracket expressions if user input is involved. - Manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype:</p> <p>```js const POSIX_REGEX_SOURCE = { __proto__: null, alnu…</p> https://db.gcve.eu/vuln/ghsa-3v7f-55p6-f55p