---
title: "glob security advisories"
description: "2 known security advisories for glob, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/glob/security
lang: en
---

[Packages](https://inlinr.com/packages)

# glob

14.0.3 · 28 Oct 2026 BlueOak-1.0.0 535.7M / week [Repository](https://github.com/isaacs/node-glob) [Homepage](https://github.com/isaacs/node-glob#readme) [npm](https://www.npmjs.com/package/glob) [Atom feed](https://inlinr.com/packages/feed/glob)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                             |
| ---- | ------ | --------------------------------------------------------------------------- |
|      | 14.0.3 | Safe from 14.0.2                                                            |
|      | 13.0.6 | 1 open advisory, worst moderate                                             |
|      | 12.0.0 | 1 open advisory, worst moderate                                             |
|      | 11.1.0 | 1 open advisory, worst moderate                                             |
|      | 10.5.0 | 1 open advisory, worst moderate                                             |
|      | 9.3.5  | 1 open advisory, worst moderate  · last release Apr 2023, no longer updated |

- High  
[glob CLI: Command injection via -c/--cmd executes matches with shell:true](https://inlinr.com/advisories/GHSA-5j98-mcp5-4vw2)GHSA-5j98-mcp5-4vw2 · 17 Nov 2025  
fixed in 11.1.0, 10.5.0
- Moderate  
[Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal](https://inlinr.com/advisories/GHSA-3g3m-2fjr-6pw4)GHSA-3g3m-2fjr-6pw4 · 30 Oct 2026  
fixed in 14.0.2

### Quality and security signals

What [npm](https://www.npmjs.com/package/glob) and [deps.dev](https://deps.dev/npm/glob) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.