Isaacs Glob vulnerabilities

• isaacs node-glob Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal CVE-2026-118773 Fix available 6.3 MediumOctober 29, 2026
• isaacs glob, node-glob +1 more glob CLI: Command injection via -c/--cmd executes matches with shell:true CVE-2025-64756 Fix available 7.5 HighNovember 17, 2025