Picomatch, a JavaScript glob matcher, contains a method injection flaw in its POSIX_REGEX_SOURCE object. Because the object inherits from Object.prototype, an attacker can craft POSIX bracket expressions like [[:constructor:]] that reference inherited method names. These method names are coerced into strings and inserted into the generated regular expression, causing the glob pattern to match unintended filenames. The flaw does not provide remote code execution but leads to integrity‑level logic errors in any application that relies on picomatch for filtering, validation, or access control.

The vulnerability affects the Picomatch library distributed by micromatch. Versions older than 4.0.4, 3.0.2, and 2.3.2 are impacted. Any Node.js application that imports picomatch and processes user‑controlled glob patterns is potentially exposed.

The flaw carries a CVSS score of 5.3 and an EPSS probability of less than 1%, indicating a moderate severity but low likelihood of exploitation. It is not listed in the CISA KEV catalog. Abuse requires only that an attacker supply a crafted glob pattern to the vulnerable library, which can happen through publicly exposed APIs or file‑system interfaces. While the attack surface is relatively narrow, the integrity consequences could allow an attacker to bypass file‑level restrictions or gain unexpected access within the application.