Prototype Pollution CVE-2026-33672

The CVSS 3.1 score of 5.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a network-accessible vulnerability with low attack complexity and low integrity impact but no confidentiality or availability impact. The attack vector is network-based with no authentication required, making exploitation straightforward for any attacker who can control glob pattern input. However, the real-world impact is constrained by the requirement that applications must (1) accept untrusted glob patterns and (2) rely on glob matching results for security decisions. The vulnerability does not lead to remote code execution, significantly limiting its severity compared to typical RCE vulnerabilities. EPSS data is not provided in the intelligence, but the low CVSS score combined with the requirement for specific application architecture (reliance on glob filtering for security) suggests moderate real-world risk rather than critical risk. Organizations using picomatch in file-filtering, access control, or validation workflows with user-controlled patterns face the highest risk; applications with trusted-input-only glob patterns face minimal risk. The availability of patches in multiple release lines (2.3.2, 3.0.2, 4.0.4) from the vendor reduces remediation friction.

An attacker controls glob patterns in a file filtering application—for example, a file upload service that uses picomatch to validate filenames against a whitelist pattern. The attacker submits a filename matching a malicious POSIX bracket expression like config[[:constructor:]]backup.json. Due to the method injection vulnerability, this pattern causes the injected method string to be embedded into the regex, altering the matching logic and allowing the malicious filename to bypass validation and pass through the filter. The attacker's file is then stored or processed when it should have been rejected, potentially leading to configuration file overwrite, privilege escalation, or other security violations depending on application logic. Exploitation requires only network access and the ability to control glob pattern input; no user interaction or special privileges are needed.