Picomatch is a glob matcher used in JavaScript projects. Versions before 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection flaw that affects the POSIX_REGEX_SOURCE object. Because that object inherits from Object.prototype, specially crafted POSIX bracket expressions such as [[:constructor:]] can reference inherited method names. Those method names are implicitly cast to strings and injected into the generated regular expression, producing incorrect glob matching. The result is a logic error where a pattern may match filenames that should not be matched, compromising integrity of any filtering, validation, or access‑control logic that relies on picomatch.

The bug affects the micromatch:picomatch library. All installations that use picomatch versions earlier than 4.0.4 in the 4.x line, earlier than 3.0.2 in the 3.x line, or earlier than 2.3.2 in the 2.x line are impacted. Any package that imports picomatch and processes untrusted or user‑controlled glob patterns is potentially exposed.

The CVSS score of 5.3 indicates a moderate impact; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited. The likely attack vector is local or supply‑chain; an attacker who supplies or influences a glob pattern that contains POSIX character classes can trigger the injection. While the flaw does not provide remote code execution or privilege escalation, it can cause unintended matches that may lead to denial of service, bypass of filtering, or other integrity violations within an application that depends on picomatch.