{"schema":"threatline.record/2","record":{"id":"GHSA-h4fr-cmh5-qr62","aliases":["GHSA-h4fr-cmh5-qr62"],"summary":"Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root","details":"### Impact\n\nFallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.\n\nThe attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:\n\n- A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory.\n- An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. When the plugin was active and declared `toolingDependencies`, the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and `--trace-dependency` printed the outside path.\n- `fallow plugin-check` reported `path_exists: true` for a seeded entry that matched only in the parent directory.\n\nFallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs.\n\nThe Jest, Vitest and Rstest project globs had the same `.*` problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case.\n\n### Patches\n\nFixed in 3.34.0. Fallow now rewrites a leading `.` in a wildcard segment to `[.]` before it expands the glob on disk. `[.]` matches the same hidden files and directories inside the project root. The `glob` crate does not test `..` against it.\n\n### Workarounds\n\nRun Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `detection`, `configPatterns` and `alwaysUsed` patterns of its plugin files.","categories":["Libraries & packages"],"product":"fallow","vendor":"","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"npm","name":"fallow"},"range":"< 3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"npm","name":"@fallow-cli/fallow-node"},"range":"< 3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"rust","name":"fallow-cli"},"range":"< 3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"rust","name":"fallow-config"},"range":"< 3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"rust","name":"fallow-core"},"range":"< 3.34.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"npm","name":"fallow"},"version":"3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"npm","name":"@fallow-cli/fallow-node"},"version":"3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"rust","name":"fallow-cli"},"version":"3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"rust","name":"fallow-config"},"version":"3.34.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source_modified_at":"2026-10-23T21:58:17Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"rust","name":"fallow-core"},"version":"3.34.0"}],"cvss":3.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T21:58:16Z","modified_at":"2026-10-23T21:58:17Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","fetched_at":"2026-10-23T22:01:05.715934Z","source_modified_at":"2026-10-23T21:58:17Z"}],"sources":["GitHub Advisory Database"],"references":[{"url":"https://github.com/fallow-rs/fallow/security/advisories/GHSA-h4fr-cmh5-qr62","source":"GitHub Advisory Database"},{"url":"https://github.com/fallow-rs/fallow/pull/3548","source":"GitHub Advisory Database"},{"url":"https://github.com/fallow-rs/fallow/commit/133d4c862c74f4b1f0a7417c65b7157c1144294d","source":"GitHub Advisory Database"},{"url":"https://github.com/fallow-rs/fallow/releases/tag/v3.34.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-h4fr-cmh5-qr62","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T21:58:17Z","content_hash":"1fc05955350b04d0deaaa03cef39de7fb98275fee198295b1816c59f58cdd41a"}}