Prototype pollution in picomatch - CVE-2026-33672

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU143925

Prototype pollution in picomatch - CVE-2026-33672

Published: August 18, 2026


Vulnerability identifier: #VU143925
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33672
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The method injection vulnerability affects the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames.. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.


Affected software

picomatch
Optim
QRadar Threat Intelligence
QRadar Deployment Intelligence App
IBM Automation Decision Services
IBM Business Automation Workflow
IBM QRadar Data Synchronization App

How to mitigate CVE-2026-33672

Install updates from vendor's website.

picomatch - addressed in versions 2.3.2, 3.0.2, 4.0.4
Optim - update to 2.0.0
IBM Automation Decision Services - addressed in versions 24.0.0.0.9, 24.0.1.0.8, 25.0.0.0.4
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM QRadar Data Synchronization App - update to 4.0.0

External References

Related Security Bulletins