CVE-2025-64756
HighAdvisory
Published 17 Nov 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.031
- 87th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 355
- of 17,781 indexed, latest versions
- Container images
- 378
- deployed by those charts
- Fix available
- 1 of 1
- affected package
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Carried by container images the latest versions of 355 of 17,781 indexed charts deploy, on 378 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| globnpm | 10.2.2, 10.2.4, 10.2.7, 10.3.1+12 more | 10.5.0, 11.1.0 | 378 |
- OSV records
- GHSA-5j98-mcp5-4vw2
Charts affected
355 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| vote-appvote-appVerified publisher | 1.0.7 | 1 of 6See more | 3,031 |
| sirenwateim | 1.0.2 | 1 of 1See more | 5,984 |
| kibanawiremindVerified publisher | 8.5.23 | 1 of 2See more | 6,285 |
| playwright-synthetic-monitoringwork-adventure | 1.0.1 | 1 of 1See more | 14,100 |
| sockpuppetbrowserzekker6Verified publisher | 0.1.0 | 1 of 1See more | 1,589 |
Container images carrying it
378 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| luligu/ | 8f97884bebc2 | glob | 10.5.0 | 1 |
| maildev/ | 180ef51f65ee | glob | 10.5.0 | 1 |
| mauricenino/ | 236997816917 | glob | 10.5.0 | 1 |
| middlewareeng/ | 747d880812f1 | glob | 10.5.0 | 1 |
| mishtinetwork/ | bb3fe67a5f7c | glob | 10.5.0 | 1 |
| mitchxxx/ | 4e72480ec63a | glob | 10.5.0 | 1 |
| moonrailgun/ | b528c8f8fcc4 | glob | 10.5.0 | 1 |
| moreillon/ | d7d4a5463525 | glob | 10.5.0 | 1 |
| moreillon/ | e8fd856e593d | glob | 10.5.0 | 1 |
| moreillon/ | 3caa8f710ee0 | glob | 10.5.0 | 1 |
| moreillon/ | d2ee0423b797 | glob | 10.5.0 | 1 |
| mpopoola1/ | 061fc532de7d | glob | 10.5.0 | 1 |
| n8nio/ | 8b39ed5a2de9 | glob | 10.5.0 | 1 |
| n8nio/ | dd171d45102a | glob | 10.5.0 | 1 |
| neoskop/ | 7f52b5949f03 | glob | 10.5.0 | 1 |
| nocodb/ | 6779a4ddedf2 | glob | 10.5.0 | 1 |
| nocodb/ | d9516f0bf546 | glob | 10.5.0 | 1 |
| nodered/ | 216e7403aab9 | glob | 10.5.0 | 1 |
| nodered/ | d73ae167cb9b | glob | 10.5.0 | 1 |
| nodered/ | e2632a7a35dd | glob | 10.5.0 | 1 |
| nottiey/ | 9c35a24c9eb3 | glob | 10.5.0 | 1 |
| oada/ | c0d077e79ef4 | glob | 10.5.0 | 1 |
| oada/ | d87efe8ba4b0 | glob | 10.5.0 | 1 |
| oada/ | ebc8343f05ff | glob | 10.5.0 | 1 |
| oada/ | c6ffb4e8ed63 | glob | 10.5.0 | 1 |
| oada/ | fc09495e2f3c | glob | 10.5.0 | 1 |
| oada/ | b7a2cfc137cf | glob | 10.5.0 | 1 |
| oada/ | b6c562fa5b1b | glob | 10.5.0 | 1 |
| oada/ | 6590c60de347 | glob | 10.5.0 | 1 |
| oada/ | 7943fde43b19 | glob | 10.5.0 | 1 |
| oada/ | 8464c7f48aae | glob | 10.5.0 | 1 |
| obolnetwork/ | e263be0a7440 | glob | 10.5.0 | 1 |
| okaforuchena/ | 004e81250f48 | glob | 10.5.0 | 1 |
| ooghenekaro/ | d1f972aa844a | glob | 10.5.0 | 1 |
| ooghenekaro/ | e010f5fecbc7 | glob | 10.5.0 | 1 |
| opea/ | 2bee4eb66f3e | glob | 10.5.0 | 1 |
| opea/ | 3ef121f34610 | glob | 10.5.0 | 1 |
| opea/ | 7f854e9bffaf | glob | 10.5.0 | 1 |
| openbas/ | a277796d9724 | glob | 10.5.0 | 1 |
| opendatacube/ | 80df355a660b | glob | 10.5.0 | 1 |
| openmined/ | d11524a3854a | glob | 10.5.0 | 1 |
| openproject/ | 88dc1359dfb5 | glob | 10.5.0 | 1 |
| oryd/ | 6465e95993b5 | glob | 10.5.0 | 1 |
| outlinewiki/ | 494dfb9249a6 | glob | 10.5.0 | 1 |
| penpotapp/ | 5c835ffd87ab | glob | 10.5.0 | 1 |
| phpdockerio/ | ea8354b42600 | glob | 10.5.0 | 1 |
| prowlercloud/ | 79ee83c8e702 | glob | 11.1.0 | 1 |
| pschiffe/ | 37ebba8c2b8f | glob | 10.5.0 | 1 |
| pumejlab/ | f563eabcb819 | glob | 10.5.0 | 1 |
| qxip/ | 77acc9c7a9fd | glob | 10.5.0 | 1 |