# GHSA-h4fr-cmh5-qr62: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root - **Severity:** Not scored - **Exploited in the wild:** Not known - **Fix available:** Yes - **Published:** 23 Oct 2026 ## What is GHSA-h4fr-cmh5-qr62? GHSA-h4fr-cmh5-qr62 is a vulnerability in fallow-cli, published on 23 Oct 2026. ### Official description ### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation. The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root: - A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory. - An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. When the plugin was active and declared `toolingDependencies`, the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and `--trace-dependency` printed the outside path. - `fallow plugin-check` reported `path_exists: true` for a seeded entry that matched only in the parent directory. Fallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs. The Jest, Vitest and Rstest project globs had the same `.*` problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case. ### Patches Fixed in 3.34.0. Fallow now rewrites a leading `.` in a wildcard segment to `[.]` before it expands the glob on disk. `[.]` matches the same hidden files and directories inside the project root. The `glob` crate does not test `..` against it. ### Workarounds Run Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `detection`, `configPatterns` and `alwaysUsed` patterns of its plugin files. ## Which versions are affected by GHSA-h4fr-cmh5-qr62? 10 open source packages ship an affected version, including fallow-cli, fallow-config and fallow-core. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `fallow-cli` | crates.io | All versions | 3.34.0 | | `fallow-cli` | crates.io | All versions | 3.34.0 | | `fallow-config` | crates.io | All versions | 3.34.0 | | `fallow-config` | crates.io | All versions | 3.34.0 | | `fallow-core` | crates.io | All versions | 3.34.0 | | `fallow-core` | crates.io | All versions | 3.34.0 | | `@fallow-cli/fallow-node` | npm | All versions | 3.34.0 | | `@fallow-cli/fallow-node` | npm | All versions | 3.34.0 | | `fallow` | npm | All versions | 3.34.0 | | `fallow` | npm | All versions | 3.34.0 | ## How do I fix GHSA-h4fr-cmh5-qr62? Upgrade fallow-cli to 3.34.0 or later. ## Is GHSA-h4fr-cmh5-qr62 being exploited? There is no known exploitation of GHSA-h4fr-cmh5-qr62 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-h4fr-cmh5-qr62 and fix it if it is affected. What it is: GHSA-h4fr-cmh5-qr62 is a vulnerability in fallow-cli, published on 23 Oct 2026. Exploitation: There is no known exploitation of GHSA-h4fr-cmh5-qr62 in the wild and no public exploit code. Affected packages and fixed versions: - fallow-cli (crates.io): affected all versions; fixed in 3.34.0 - fallow-cli (crates.io): affected all versions; fixed in 3.34.0 - fallow-config (crates.io): affected all versions; fixed in 3.34.0 - fallow-config (crates.io): affected all versions; fixed in 3.34.0 - fallow-core (crates.io): affected all versions; fixed in 3.34.0 - fallow-core (crates.io): affected all versions; fixed in 3.34.0 - @fallow-cli/fallow-node (npm): affected all versions; fixed in 3.34.0 - @fallow-cli/fallow-node (npm): affected all versions; fixed in 3.34.0 - fallow (npm): affected all versions; fixed in 3.34.0 - fallow (npm): affected all versions; fixed in 3.34.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-h4fr-cmh5-qr62/ (Markdown: https://insights.sbomify.com/GHSA-h4fr-cmh5-qr62/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-h4fr-cmh5-qr62 --- From sbomify Insights: https://insights.sbomify.com/GHSA-h4fr-cmh5-qr62/ Summaries are generated and may contain mistakes; the official description above is the record.