isaacs node-glob

• CVE-2026-118773 Medium 6.3 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal 0.4%
• CVE-2025-64756 High 7.5 glob CLI: Command injection via -c/--cmd executes matches with shell:true 3.1%