CVE-2026-33672
Method Injection in Picomatch Glob Matcher Causes Logic Errors
Publication date: 2026-03-26
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jonschlinkert | picomatch | to 2.3.2 (exc) |
| jonschlinkert | picomatch | From 3.0.0 (inc) to 3.0.2 (exc) |
| jonschlinkert | picomatch | From 4.0.0 (inc) to 4.0.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade picomatch to a fixed version: 4.0.4, 3.0.2, or 2.3.2 or later, depending on your release line.
If upgrading immediately is not possible, avoid passing untrusted or user-controlled glob patterns to picomatch.
- Sanitize or reject glob patterns containing POSIX character classes like `[[:...:]]`.
- Avoid using POSIX bracket expressions if user input is involved.
As a manual mitigation, patch the library by modifying the `POSIX_REGEX_SOURCE` object to use a null prototype to prevent method injection.
Can you explain this vulnerability to me?
The vulnerability exists in the Picomatch JavaScript library, which is used for glob pattern matching. In affected versions prior to 4.0.4, 3.0.2, and 2.3.2, a method injection vulnerability affects the POSIX_REGEX_SOURCE object. This object inherits from Object.prototype, allowing specially crafted POSIX bracket expressions (such as [[:constructor:]]) to reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression, causing incorrect glob matching behavior.
This means that patterns may match unintended filenames, leading to integrity issues in applications that rely on glob matching for filtering, validation, or access control. The vulnerability does not allow remote code execution but can cause security-relevant logic errors.
How can this vulnerability impact me? :
This vulnerability can impact applications that use the affected versions of Picomatch to process untrusted or user-controlled glob patterns. Because the vulnerability causes incorrect glob matching, it may result in unintended filenames being matched.
Such incorrect matching can lead to security-relevant logic errors, for example, bypassing filtering, validation, or access control mechanisms that depend on accurate glob matching. This can compromise the integrity of the application’s security controls.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects specific versions of the picomatch JavaScript library (versions prior to 4.0.4, 3.0.2, and 2.3.2). Detection involves identifying if your system or application uses an affected version of picomatch.
Since this is a library vulnerability related to glob pattern matching, detection commands would focus on checking the installed picomatch version in your project or environment.
- Run `npm list picomatch` in your project directory to see the installed version of picomatch.
- Alternatively, check your package-lock.json or yarn.lock files for picomatch version entries.
There are no specific network or system commands to detect exploitation of this vulnerability because it does not involve network activity or remote code execution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes incorrect glob matching behavior, which can lead to security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control.
While it does not enable remote code execution, the integrity impact could potentially affect compliance with standards and regulations that require strict data access controls and validation, such as GDPR and HIPAA.
Applications processing untrusted or user-controlled glob patterns may inadvertently allow unintended file matches, which could lead to unauthorized data exposure or improper access control enforcement.
Therefore, failure to address this vulnerability might result in non-compliance with regulations that mandate protecting sensitive data and ensuring proper access restrictions.