Mitigation Strategies

The primary mitigation is to upgrade picomatch to a fixed version: 4.0.4, 3.0.2, or 2.3.2 or later, depending on your release line.

If upgrading immediately is not possible, avoid passing untrusted or user-controlled glob patterns to picomatch.

• Sanitize or reject glob patterns containing POSIX character classes like `[[:...:]]`.
• Avoid using POSIX bracket expressions if user input is involved.

As a manual mitigation, patch the library by modifying the `POSIX_REGEX_SOURCE` object to use a null prototype to prevent method injection.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the Picomatch JavaScript library, which is used for glob pattern matching. In affected versions prior to 4.0.4, 3.0.2, and 2.3.2, a method injection vulnerability affects the POSIX_REGEX_SOURCE object. This object inherits from Object.prototype, allowing specially crafted POSIX bracket expressions (such as [[:constructor:]]) to reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression, causing incorrect glob matching behavior.

This means that patterns may match unintended filenames, leading to integrity issues in applications that rely on glob matching for filtering, validation, or access control. The vulnerability does not allow remote code execution but can cause security-relevant logic errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact applications that use the affected versions of Picomatch to process untrusted or user-controlled glob patterns. Because the vulnerability causes incorrect glob matching, it may result in unintended filenames being matched.

Such incorrect matching can lead to security-relevant logic errors, for example, bypassing filtering, validation, or access control mechanisms that depend on accurate glob matching. This can compromise the integrity of the application’s security controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects specific versions of the picomatch JavaScript library (versions prior to 4.0.4, 3.0.2, and 2.3.2). Detection involves identifying if your system or application uses an affected version of picomatch.

Since this is a library vulnerability related to glob pattern matching, detection commands would focus on checking the installed picomatch version in your project or environment.

• Run `npm list picomatch` in your project directory to see the installed version of picomatch.
• Alternatively, check your package-lock.json or yarn.lock files for picomatch version entries.

There are no specific network or system commands to detect exploitation of this vulnerability because it does not involve network activity or remote code execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes incorrect glob matching behavior, which can lead to security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control.

While it does not enable remote code execution, the integrity impact could potentially affect compliance with standards and regulations that require strict data access controls and validation, such as GDPR and HIPAA.

Applications processing untrusted or user-controlled glob patterns may inadvertently allow unintended file matches, which could lead to unauthorized data exposure or improper access control enforcement.

Therefore, failure to address this vulnerability might result in non-compliance with regulations that mandate protecting sensitive data and ensuring proper access restrictions.

Useful 0 Not Useful 0