UI5 / webcomponents-react
85%
main: 85%

LAST BUILD BRANCH: renovate/root-ui5-webcomponents
DEFAULT BRANCH: main
Repo Added
Token oPWbg1az908gQvSJuuJozJ1sPPNWz9O6K regen
Build 884 Last
Files 231
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH gh-readonly-queue/main/pr-7950-e775f5285b979afe7845e7f7869e573a837347bb
branch: gh-readonly-queue/main/pr-7950-e775f5285b979afe7845e7f7869e573a837347bb
CHANGE BRANCH
x
Sync Branches

coverage: 84.91% (-0.02%) from 84.929%
19459145497

push

github

web-flow 
chore(deps): update dependency glob to v11.1.0 [security] (#7950)

This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| [glob](https://redirect.github.com/isaacs/node-glob) | [`11.0.3` ->
`11.1.0`](https://renovatebot.com/diffs/npm/glob/11.0.3/11.1.0) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/glob/11.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/glob/11.0.3/11.1.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-64756](https://redirect.github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2)

### Summary

The glob CLI contains a command injection vulnerability in its
`-c/--cmd` option that allows arbitrary command execution when
processing files with malicious names. When `glob -c <command>
<patterns>` is used, matched filenames are passed to a shell with
`shell: true`, enabling shell metacharacters in filenames to trigger
command injection and achieve arbitrary code execution under the user or
CI account privileges.

### Details

**Root Cause:**
The vulnerability exists in `src/bin.mts:277` where the CLI collects
glob matches and executes the supplied command using `foregroundChild()`
with `shell: true`:

```javascript
stream.on('end', () => foregroundChild(cmd, matches, { shell: true }))
```

**Technical Flow:**
1. User runs `glob -c <command> <pattern>` 
2. CLI finds files matching the pattern
3. Matched filenames are collected into an array
4. Command is executed with matched filenames as arguments using `shell:
true`
5. Shell interprets metacharacters in filenames as command syntax
6. Malicious filenames execute arbitrary commands

**Affected Component:**
- **CLI Only:** The vulnerability affects only the command-line
interface
- **Library Safe:** The core glob library API (`glob()`, `globSync()`,
streams/iterators) is not... (continued)

3263 of 4169 branches covered (78.27%)

Branch coverage included in aggregate %.

5740 of 6434 relevant lines covered (89.21%)

118565.16 hits per line

Relevant lines Covered
6434 RELEVANT LINES 5740 COVERED LINES
118565.16 HITS PER LINE
Source Files on gh-readonly-queue/main/pr-7950-e775f5285b979afe7845e7f7869e573a837347bb

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
19459145497 gh-readonly-queue/main/pr-7950-e775f5285b979afe7845e7f7869e573a837347bb chore(deps): update dependency glob to v11.1.0 [security] (#7950) This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [glob](https://redirect.github.com/isaacs/node-glob) | [`11.0.3` -> `11.1.0`](h... push web-flow github
84.91
See All Builds (876)

Badge your Repo: webcomponents-react

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh