[GH-ISSUE #257] Security Upgrade Required: glob CLI Command Injection (CVE-2025-64756) #94

New issue

Closed

opened 2026-03-02 04:11:47 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 04:11:47 +03:00

Owner

Originally created by @alexanderGalushka on GitHub (Dec 3, 2025).
Original GitHub issue: https://github.com/git-ai-project/git-ai/issues/257

Description:
A high-severity security vulnerability has been identified in the glob CLI package used by this project. The issue allows command injection when executing matches with shell: true via -c / --cmd. This can allow untrusted input to spawn arbitrary shell commands.

CVE:
CVE-2025-64756

Severity:
HIGH

Installed Version:
10.4.5

Patched Version:
11.1.0

Required Action:
Upgrade the dependency to glob >= 11.1.0.
Confirm removal of any code paths that rely on shell: true.
Perform regression testing to ensure glob API changes do not break existing CLI workflows.

Originally created by @alexanderGalushka on GitHub (Dec 3, 2025). Original GitHub issue: https://github.com/git-ai-project/git-ai/issues/257 Description: A high-severity security vulnerability has been identified in the glob CLI package used by this project. The issue allows command injection when executing matches with shell: true via -c / --cmd. This can allow untrusted input to spawn arbitrary shell commands. CVE: CVE-2025-64756 Severity: HIGH Installed Version: 10.4.5 Patched Version: 11.1.0 Required Action: Upgrade the dependency to glob >= 11.1.0. Confirm removal of any code paths that rely on shell: true. Perform regression testing to ensure glob API changes do not break existing CLI workflows.

kerem closed this issue

2026-03-02 04:11:47 +03:00

kerem commented

2026-03-02 04:11:48 +03:00

Author

Owner

@svarlamov commented on GitHub (Dec 4, 2025):

Thanks for the report, Alexander! Fix came out in the latest release. Please run git-ai upgrade to get it

@svarlamov commented on GitHub (Dec 4, 2025): Thanks for the report, Alexander! Fix came out in the latest release. Please run `git-ai upgrade` to get it

kerem referenced this issue

2026-03-02 04:13:05 +03:00

[PR #94] Track time for AI and user messages #250