{"id":"GHSA-h4fr-cmh5-qr62","title":"Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root","summary":"Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root","severity":"low","cvss":3.3,"cwe":["CWE-22"],"vendor":"fallow","product":"fallow","ecosystem":"npm","affected":["fallow < 3.34.0","@fallow-cli/fallow-node < 3.34.0","fallow-cli < 3.34.0","fallow-config < 3.34.0","fallow-core < 3.34.0"],"patched":["fallow 3.34.0","@fallow-cli/fallow-node 3.34.0","fallow-cli 3.34.0","fallow-config 3.34.0","fallow-core 3.34.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:58:17Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","references":[{"url":"https://github.com/fallow-rs/fallow/security/advisories/GHSA-h4fr-cmh5-qr62"},{"url":"https://github.com/fallow-rs/fallow/pull/3548"},{"url":"https://github.com/fallow-rs/fallow/commit/133d4c862c74f4b1f0a7417c65b7157c1144294d"},{"url":"https://github.com/fallow-rs/fallow/releases/tag/v3.34.0"},{"url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-24T00:46:53.670Z","slug":"GHSA-h4fr-cmh5-qr62","body":"## Overview\n\n### Impact\n\nFallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.\n\nThe attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:\n\n- A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory.\n- An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. When the plugin was active and declared `toolingDependencies`, the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and `--trace-dependency` printed the outside path.\n- `fallow plugin-check` reported `path_exists: true` for a seeded entry that matched only in the parent directory.\n\nFallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs.\n\nThe Jest, Vitest and Rstest project globs had the same `.*` problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case.\n\n### Patches\n\nFixed in 3.34.0. Fallow now rewrites a leading `.` in a wildcard segment to `[.]` before it expands the glob on disk. `[.]` matches the same hidden files and directories inside the project root. The `glob` crate does not test `..` against it.\n\n### Workarounds\n\nRun Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `detection`, `configPatterns` and `alwaysUsed` patterns of its plugin files.\n\n## Affected packages\n\n- `fallow < 3.34.0`\n- `@fallow-cli/fallow-node < 3.34.0`\n- `fallow-cli < 3.34.0`\n- `fallow-config < 3.34.0`\n- `fallow-core < 3.34.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fallow 3.34.0`\n- `@fallow-cli/fallow-node 3.34.0`\n- `fallow-cli 3.34.0`\n- `fallow-config 3.34.0`\n- `fallow-core 3.34.0`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}