GHSA-c2c7-rcm5-vvqj high
Picomatch has a ReDoS vulnerability via extglob quantifiers
Affected range
SEMVER: introduced 4.0.0; fixed 4.0.4SEMVER: introduced 3.0.0; fixed 3.0.2SEMVER: introduced 0; fixed 2.3.2Fixed versions: 4.0.4, 3.0.2, 2.3.2
picomatch
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
npm latest 4.0.7 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
4.0.7
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
2 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-3v7f-55p6-f55p moderate
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Affected range
SEMVER: introduced 4.0.0; fixed 4.0.4SEMVER: introduced 3.0.0; fixed 3.0.2SEMVER: introduced 0; fixed 2.3.2Fixed versions: 4.0.4, 3.0.2, 2.3.2