CLEANSTART-2026-NX65615: Glob matches files using patterns the shell uses

Q: What does an attacker need to exploit this issue?

The vulnerability is network-reachable, requires low privileges, and does not require user interaction. Exploitation has high attack complexity, indicating additional conditions are required beyond simply reaching the affected package.

Q: What could a successful exploit allow?

A successful exploit could have high impact on confidentiality, integrity, and availability of the affected system. The CVSS vector indicates the impact remains within the vulnerable component's security authority.

Published Nov 5, 2026

Updated

Security vulnerability affects the npm package. Glob matches files using patterns the shell uses.

Affected Software

1 affected componentFixes available

cleanstart/npm<10.9.2-r1

10.9.2-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 10.9.2-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·06:32 AM

Data Sourced

via OSV·06:32 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-64756

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vulnerability is network-reachable, requires low privileges, and does not require user interaction. Exploitation has high attack complexity, indicating additional conditions are required beyond simply reaching the affected package.

What could a successful exploit allow?

A successful exploit could have high impact on confidentiality, integrity, and availability of the affected system. The CVSS vector indicates the impact remains within the vulnerable component's security authority.

CLEANSTART-2026-NX65615: Glob matches files using patterns the shell uses

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What could a successful exploit allow?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What could a successful exploit allow?