{
  "@id": "urn:uuid:2832c8ef-ba62-4e67-8daa-fe8c498fcaf8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T03:51:00.045667+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/glob@7.1.6",
          "identifiers": {
            "purl": "pkg:npm/glob@7.1.6"
          }
        }
      ],
      "timestamp": "2026-11-06T03:51:00.045667+00:00",
      "status_notes": "Vulnerability CVE-2025-64756 affects version 7.1.6 of glob.",
      "vulnerability": {
        "name": "CVE-2025-64756"
      },
      "action_statement": "Vulnerability CVE-2025-64756 affects version 7.1.6 of glob."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/glob@7.1.6",
          "identifiers": {
            "purl": "pkg:npm/glob@7.1.6"
          }
        }
      ],
      "timestamp": "2026-11-04T01:38:13.876875+00:00",
      "status_notes": "Vulnerability CVE-2026-118773 does not affect version 7.1.6 of glob. not_affected \u2014 CVE-2026-118773 affects glob v9.0.0-v13.0.6 (TypeScript rewrite) where abort checks in src/walker.ts are missing return statements, allowing directory traversal to continue after abort. The target (v7.1.6) uses the older JavaScript codebase (glob.js) which never had this vulnerability pattern. All abort checks in v7.1.6 have proper `if (this.aborted) return` statements, preventing execution fro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-118773"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-118773 affects glob v9.0.0-v13.0.6 (TypeScript rewrite) where abort checks in src/walker.ts are missing return statements, allowing directory traversal to continue after abort. The target (v7.1.6) uses the older JavaScript codebase (glob.js) which never had this vulnerability pattern. All abort checks in v7.1.6 have proper `if (this.aborted) return` statements, preventing execution fro..."
    }
  ]
}