The vulnerability CVE-2025-64756 affects the glob command-line interface component used by the Red Hat Trusted Artifact Signer (RHTAS) Operator versions >=1.3.0 <=1.3.2. The flaw is a command injection caused by improper sanitization of filenames containing shell metacharacters when the glob CLI is used with the -c/--cmd option. This allows an attacker who can create or trick the system into processing files with malicious names to execute arbitrary OS commands. The glob CLI uses the shell:true parameter when spawning subprocesses, enabling shell expansions that lead to code execution. Although the nodejs-glob package’s CLI is not used by npm and not exposed in the user’s $PATH, the vulnerability remains present in the CLI tool. The Red Hat advisory does not list a fix or patch for this issue. The vulnerability is associated with multiple CWEs including CWE-78 (OS Command Injection). The impact includes unauthorized code execution, potential denial of service, and unauthorized data access or modification. The advisory recommends avoiding use of the glob CLI with the -c/--cmd option on untrusted input or sanitizing filenames before execution.

This vulnerability allows attackers with the ability to create or influence filenames processed by the glob CLI with the -c/--cmd option to execute arbitrary operating system commands. This can lead to unauthorized code execution, denial of service (crash or restart), and unauthorized reading or modification of files and application data. Since commands execute with the privileges of the application, malicious actions may appear to originate from the trusted application or its owner, increasing the risk of stealthy attacks and data compromise.

No official patch or fix is currently provided for this vulnerability in the Red Hat advisory. To mitigate the risk, avoid using the glob command-line interface with the -c or --cmd option on filenames from untrusted sources. If programmatic use of glob with command execution is necessary, ensure all filenames are thoroughly sanitized to remove shell metacharacters before passing them to commands executed with shell interpretation enabled. Monitor Red Hat advisories for future updates or patches addressing this issue.