Executive brief
Picomatch is a JavaScript library that matches file paths against glob patterns, widely used in build tools, test runners, and file processing applications. A vulnerability in its POSIX character class handling allows malicious glob patterns to inject inherited object methods into the matching logic, causing patterns to match unintended files. While this does not enable code execution, it can undermine security checks that rely on glob matching for file filtering or access control decisions.
Technical details
Picomatch is vulnerable to a method injection vulnerability (CWE-1321) in the POSIX_REGEX_SOURCE object used to process POSIX bracket expressions like [[:alnum:]]. Because this object inherits from Object.prototype, specially crafted patterns such as [[:constructor:]] can reference inherited method names, which are implicitly converted to strings and injected into the generated regular expression. This occurs when user-controlled or untrusted glob patterns are passed to picomatch without sanitization. The vulnerability affects versions 2.x (before 2.3.2), 3.x (before 3.0.2), and 4.x (before 4.0.4). Exploitation leads to incorrect pattern matching behavior affecting the integrity of file filtering logic, but does not enable remote code execution. Patches are available in picomatch 2.3.2, 3.0.2, and 4.0.4, and the recommended mitigation is to use a null prototype object for POSIX_REGEX_SOURCE.
Affected products
- micromatch picomatch 2.x before 2.3.2, 3.x before 3.0.2, 4.x before 4.0.4
Timeline
- 2026-03-25: disclosed: Vulnerability published as GHSA-3v7f-55p6-f55p
- 2026-03-25: patched: Patches released: picomatch 2.3.2, 3.0.2, 4.0.4