Critical Vulnerability in Glob-Parent Package: Regex Enclosure Issue
Summary
CVE-2020-28469: This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. Affects node-glob-parent across 2 version ranges.
< 5.1.1+~5.1.0-2
< eb2c439de448c779b450472e591a2bc9e37e9668
Fixed in 5.1.1+~5.1.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Glob-Parent package is a widely used Node.js library that resolves the parent directory of glob patterns. It is essential for file and directory manipulation in various JavaScript applications. However, prior to version 5.1.2, it contained a regex vulnerability that could lead to security issues, particularly when handling paths with enclosure characters.
Vulnerability Detail
This vulnerability, identified as CVE-2020-28469, affects the Glob-Parent package versions before 5.1.2. The issue arises from a flawed regex used to validate strings that end with enclosure characters containing path separators. This flaw can potentially allow attackers to manipulate file paths, leading to unauthorized access or file disclosure. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
5.1.1+~5.1.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-glob-parentTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize paths before processing them. This can help mitigate the risk associated with the regex vulnerability until a proper update can be applied.
Conclusion
The Glob-Parent package has a critical vulnerability that can be exploited if not addressed. It is essential to update to version 5.1.2 or later to mitigate risks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-glob-parent →
FAQ
CVE-2020-28469 is a security vulnerability in the Glob-Parent package that affects versions prior to 5.1.2, caused by a flawed regex for validating enclosure characters in file paths.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could allow attackers to manipulate file paths, leading to unauthorized access or exposure of sensitive files within your application.
Implement input validation to sanitize paths as a temporary workaround until you can update to a secure version of the Glob-Parent package.
More details can be found in the official CVE database or by visiting the GitHub repository for the Glob-Parent package.
Related vulnerabilities
Recent vulnerabilities recorded for node-glob-parent.
