CVE-2025-64756 is a command injection vulnerability in the glob CLI component used by Red Hat Trusted Artifact Signer (RHTAS) versions >=1.2.0 <1.2.2. The glob CLI uses the -c/--cmd option to execute shell commands on files matching a pattern, but it fails to sanitize filenames containing shell metacharacters. This allows an attacker who can create or influence filenames processed by glob to execute arbitrary OS commands. The vulnerability is due to the shell:true parameter used in subprocess execution, which interprets shell metacharacters in filenames. Exploitation requires the attacker to have permission to create or trick the user into processing maliciously named files. The vulnerability is present in the glob CLI but not in the programmatic use of the glob package by npm. Red Hat has not yet released a patch for RHTAS but has published advisory RHSA-2026:2925 describing the issue and mitigation recommendations.

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the user running the glob CLI. This can lead to unauthorized code execution, data modification or disclosure, and potential denial of service by crashing or disrupting the application. Because the commands execute in the context of the application, malicious actions may appear to originate from the application or its owner, complicating detection and attribution.

Avoid using the glob CLI with the -c or --cmd option on filenames from untrusted sources. If programmatic use of glob with shell command execution is necessary, ensure all filenames are thoroughly sanitized to remove shell metacharacters before execution. Monitor Red Hat advisories for an official patch release for RHTAS 1.2.2 or later. Until a fix is available, restrict permissions to prevent untrusted users from creating files processed by glob with the -c option.