Detections
Analytics

SCA: security update for picomatch (GHSA-3v7f-55p6-f55p)

medium Tenable Cloud Security Plugin ID 439220

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable
 to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits
 from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can
 reference inherited method names. These methods are implicitly converted to strings and injected into the
 generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where
 patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause
 security-relevant logic errors in applications that rely on glob matching for filtering, validation, or
 access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob
 patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should
 upgrade to one of these versions or later, depending on their supported release line. If upgrading is not
 immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include
 sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like
 `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually
 patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype. (CVE-2026-33672)

Solution

Update the picomatch library and its related packages to version 2.3.2 or later.

See Also

https://github.com/advisories/GHSA-3v7f-55p6-f55p

Plugin Details

Severity: Medium

ID: 439220

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 3/26/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 51.13

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-33672

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/25/2026

Vulnerability Publication Date: 3/25/2026

Reference Information

CVE: CVE-2026-33672