Prototype pollution in picomatch - CVE-2026-33672
Published: August 18, 2026
Vulnerability identifier: #VU143925
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33672
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The method injection vulnerability affects the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames.. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
Affected software
picomatch
IBM QRadar Data Synchronization App
IBM QRadar Data Synchronization App
How to mitigate CVE-2026-33672
Install updates from vendor's website.
picomatch - addressed in versions 2.3.2, 3.0.2, 4.0.4
IBM QRadar Data Synchronization App - update to 4.0.0
IBM QRadar Data Synchronization App - update to 4.0.0