5.3

CVE-2026-33672: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Analyzed
AliasesUBUNTU-CVE-2026-33672DEBIAN-CVE-2026-33672CGA-228h-4v6m-95q2
Published 26-03-2026Last modified 27-03-2026

Vulnerability summary

CVE-2026-33672 is a medium (CVSS 5.3) vulnerability in jonschlinkert picomatch. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · -0.08 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-H3VP-4FV3-55PP

Timeline

  1. 26-03-2026
    PublishedVulnerability first disclosed.
  2. 27-03-2026
    Last modifiedVulnerability information updated.

Description

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

Decrease -0.08 pp

From 0.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard101 products
  • actions-runner< 2.333.1-r1
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14.4-r15
  • arangodb-3.12< 3.12.9.4-r27
Wolfi28 products
  • argo-workflows-ui-4.0< 4.0.3-r2
  • code-server< 4.112.0-r2
  • katib-earlystopping< 0.19.0-r25
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r25
Debian1 product
  • node-anymatchAll versions (No fix recorded) | < 3.1.3+~cs8.0.6-1
Jonschlinkert1 product
  • picomatch< 2.3.2 | ≥ 3.0.0, < 3.0.2 | ≥ 4.0.0, < 4.0.4
Micromatch1 product
  • picomatch≥ 4.0.0, < 4.0.4 | ≥ 3.0.0, < 3.0.2 | < 2.3.2
Npm1 product
  • picomatch≥ 4.0.0, < 4.0.4 | ≥ 3.0.0, < 3.0.2 | < 2.3.2
Ubuntu1 product
  • node-anymatchAll versions (No fix recorded)

7 vendors · 134 products

References

8 links