glob
14.0.3 · 28 Oct 2026BlueOak-1.0.0535.7M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 14.0.3 | Safe from 14.0.2 | |
| 13.0.6 | 1 open advisory, worst moderate | |
| 12.0.0 | 1 open advisory, worst moderate | |
| 11.1.0 | 1 open advisory, worst moderate | |
| 10.5.0 | 1 open advisory, worst moderate | |
| 9.3.5 | 1 open advisory, worst moderate · last release Apr 2023, no longer updated |
- Highglob CLI: Command injection via -c/--cmd executes matches with shell:trueGHSA-5j98-mcp5-4vw2 · 17 Nov 2025fixed in 11.1.0, 10.5.0
- ModerateGlob: AbortSignal cancellation bypass allows post-timeout filesystem traversalGHSA-3g3m-2fjr-6pw4 · 30 Oct 2026fixed in 14.0.2
Registry facts last checked 4 Nov 2026. Releases and advisories last read 4 Nov 2026.