A command injection vulnerability in isaacs node-glob allows attackers to execute arbitrary code with the privileges of the user or CI account running the utility.

This is an OS Command Injection vulnerability (CWE-78) where the glob CLI incorrectly handles filenames when the --cmd option is used, allowing an authenticated user or automated process to trigger arbitrary code execution via shell metacharacters in filenames.

The vulnerability carries a CVSS score of 7.5, indicating a high risk of compromise. Successful exploitation grants an attacker the ability to execute commands in the context of the running application, which could lead to full system takeover, data theft, or the compromise of CI/CD pipeline integrity.

Immediate Action: Update the node-glob package to version 10.5.0 or 11.1.0 immediately to include the necessary security patches.

Proactive Monitoring: Review CI/CD logs and build scripts for unusual execution patterns or commands involving the glob CLI that deviate from standard build processes.

Compensating Controls: Restrict the ability of untrusted users to influence filenames or patterns processed by the glob CLI in automated environments.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution, organizations using node-glob in build systems or automated scripts must prioritize this update. Applying the patch to versions 10.5.0 or 11.1.0 is essential to prevent potential command injection attacks that could bypass security boundaries in development or production environments.