Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable     to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits     from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can     reference inherited method names. These methods are implicitly converted to strings and injected into the     generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where     patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause     security-relevant logic errors in applications that rely on glob matching for filtering, validation, or     access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob     patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should     upgrade to one of these versions or later, depending on their supported release line. If upgrading is not     immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include     sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like     `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually     patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype. (CVE-2026-33672)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable
    to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits
    from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can
    reference inherited method names. These methods are implicitly converted to strings and injected into the
    generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where
    patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause
    security-relevant logic errors in applications that rely on glob matching for filtering, validation, or
    access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob
    patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should
    upgrade to one of these versions or later, depending on their supported release line. If upgrading is not
    immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include
    sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like
    `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually
    patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype. (CVE-2026-33672)

ID	Name	Product	Family	Severity
304000	Linux Distros Unpatched Vulnerability : CVE-2026-33672	Nessus	Misc.	medium
439220	SCA: security update for picomatch (GHSA-3v7f-55p6-f55p)	Tenable Cloud Security	SCA Checks	medium
439220	SCA: security update for picomatch (GHSA-3v7f-55p6-f55p)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33672

medium

Tenable Plugins

medium

medium

medium