UnratedFix available

DEBIAN-CVE-2026-33672

Type: advisorySource: OSV1 source record

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.

Announced 26 Mar 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-33672

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-33672

node-anymatch

Source reference: /affected/0/package/name

Affected versions: 3.1.3+~cs4.6.1-2
Source reference: /affected/0/versions
3.1.3+~cs8.0.5-1
Source reference: /affected/0/versions
3.1.3+~cs8.0.6-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-anymatch

Source reference: /affected/1/package/name

Affected versions: 3.1.3+~cs4.6.1-2
Source reference: /affected/1/versions
3.1.3+~cs8.0.5-1
Source reference: /affected/1/versions
3.1.3+~cs8.0.6-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-anymatch

Source reference: /affected/2/package/name

Affected versions: 3.1.3+~cs4.6.1-2
Source reference: /affected/2/versions
3.1.3+~cs8.0.5-1
Source reference: /affected/2/versions
Fixed versions: 3.1.3+~cs8.0.6-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-anymatch",
      "purl": "pkg:deb/debian/node-anymatch?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "3.1.3+~cs4.6.1-2",
      "3.1.3+~cs8.0.5-1",
      "3.1.3+~cs8.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33672.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-anymatch",
      "purl": "pkg:deb/debian/node-anymatch?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "3.1.3+~cs4.6.1-2",
      "3.1.3+~cs8.0.5-1",
      "3.1.3+~cs8.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33672.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.1.3+~cs8.0.6-1"
          }
        ]
      }
    ],
    "package": {
      "name": "node-anymatch",
      "purl": "pkg:deb/debian/node-anymatch?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "3.1.3+~cs4.6.1-2",
      "3.1.3+~cs8.0.5-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33672.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56400 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:35:59 GMT
Publisher date: Thu, 26 Mar 2026 22:16:30 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-33672 · Revision 1Source updated