CVE-2026-33672: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Impact picomatch is vulnerable to a method injection vulnerability (CWE-1321) affecting the POSIXREGEXSOURCE object. Because the object inherits from Object.prototype, specially crafted POSIX bracket expressions (e.g., [[:constructor:]]) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression.
This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control.
All users of affected picomatch versions that process untrusted or user-controlled glob patterns are potentially impacted.
Patches
This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2.
Users should upgrade to one of these versions or later, depending on their supported release line.
Workarounds
If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch.
Possible mitigations include: - Sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like [[:...:]]. - Avoiding the use of POSIX bracket expressions if user input is involved. - Manually patching the library by modifying POSIXREGEXSOURCE to use a null prototype:
js const POSIXREGEXSOURCE = { proto: null, alnum: 'a-zA-Z0-9', alpha: 'a-zA-Z', // ... rest unchanged }; Resources
- fix for similar issue: https://github.com/micromatch/picomatch/pull/144 - picomatch repository https://github.com/micromatch/picomatch
Other sources
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the POSIXREGEXSOURCE object. Because the object inherits from Object.prototype, specially crafted POSIX bracket expressions (e.g., [[:constructor:]]) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected picomatch versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like [[:...:]]; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying POSIXREGEXSOURCE to use a null prototype.
— MITRE
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/picomatchto a version that resolves this vulnerability.Fixed in 2.3.2 - Upgrade
Upgrade
npm/picomatchto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
npm/picomatchto a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
picomatchto a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
picomatchto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
picomatchto a version that resolves this vulnerability.Fixed in 2.3.2 - Configuration
Manually patch picomatch by modifying POSIX_REGEX_SOURCE to use a null prototype (set __proto__: null) to prevent method injection via inherited Object.prototype methods.
picomatch POSIX_REGEX_SOURCE prototype = __proto__: null - Configuration
Sanitize or reject untrusted glob patterns, especially those containing POSIX character classes such as `[[:...:]]`.
picomatch glob pattern sanitization/rejection = Reject/sanitize POSIX character classes like `[[:...:]]` - Compensating control
If upgrading is not immediately possible, avoid passing untrusted or user-controlled glob patterns to picomatch.
- Compensating control
Avoid using POSIX bracket expressions (e.g., POSIX character class syntax) when the glob pattern includes user input.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33672?
CVE-2026-33672 is classified as a method injection vulnerability impacting the `POSIX_REGEX_SOURCE` object in picomatch.
How do I fix CVE-2026-33672?
To fix CVE-2026-33672, update picomatch to version 2.3.2, 3.0.2, or 4.0.4 depending on your current version.
What software is affected by CVE-2026-33672?
CVE-2026-33672 affects versions of the picomatch library prior to 2.3.2, as well as versions 3.0.0 to 3.0.2 and 4.0.0 to 4.0.4.
What is a method injection vulnerability in CVE-2026-33672?
A method injection vulnerability, such as that in CVE-2026-33672, allows attackers to manipulate inherited methods in the `POSIX_REGEX_SOURCE` object.
Who is impacted by CVE-2026-33672?
Developers using vulnerable versions of the picomatch library are impacted by CVE-2026-33672 due to potential security risks associated with method injection.