The glob CLI has a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with maliciously crafted names containing shell metacharacters. This occurs because matched filenames are passed to a shell with shell: true, enabling injection of arbitrary shell commands. The vulnerability affects glob CLI versions from 10.2.0 up to but not including 10.5.0 and 11.0.0 up to but not including 11.1.0. The core glob library API is not affected. Exploitation requires attacker control over filenames and a shell environment, primarily on POSIX systems. The vulnerability can lead to arbitrary code execution with the privileges of the user running the CLI, impacting developer workstations, CI/CD pipelines, and automated processing systems. Patches are available in versions 10.5.0 and 11.1.0.