Detections
Analytics

SCA: security update for glob (GHSA-3g3m-2fjr-6pw4)

medium Tenable Self-Hosted Container Security Plugin ID 478081

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in
 src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and
 GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout()
 rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and
 recursive traversal. The issue affects glob() and globStream() when applications expose attacker-
 influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out
 requests can stack background filesystem operations and CPU work, degrading worker throughput or service
 availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.
 (CVE-2026-118773)

Solution

Update the glob library and its related packages to version 14.0.2 or later.

See Also

https://github.com/advisories/GHSA-3g3m-2fjr-6pw4

Plugin Details

Severity: Medium

ID: 478081

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.55

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-118773

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/30/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-118773

cwe: CWE-400