---
id: "GHSA-h4fr-cmh5-qr62"
kind: "vulnerability"
aliases: ["GHSA-h4fr-cmh5-qr62"]
title: "Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fallow", "fixed": ["3.34.0"], "affected": "< 3.34.0", "ecosystem": "npm"}, {"name": "@fallow-cli/fallow-node", "fixed": ["3.34.0"], "affected": "< 3.34.0", "ecosystem": "npm"}, {"name": "fallow-cli", "fixed": ["3.34.0"], "affected": "< 3.34.0", "ecosystem": "cargo"}, {"name": "fallow-config", "fixed": ["3.34.0"], "affected": "< 3.34.0", "ecosystem": "cargo"}, {"name": "fallow-core", "fixed": ["3.34.0"], "affected": "< 3.34.0", "ecosystem": "cargo"}]
ecosystems: ["cargo", "npm"]
tags: ["cargo", "ci", "cwe-22", "fallow", "npm", "package", "pull-request-analysis"]
not_affected_if: ["fixed-version", "no-untrusted-plugin-files", "trusted-repos-only"]
published_at: "2026-10-23T21:58:16+00:00"
first_seen_at: "2026-10-23T22:05:18+00:00"
updated_at: "2026-10-25T04:45:47+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h4fr-cmh5-qr62", "first_seen_at": "2026-10-23T22:05:18+00:00"}]
---

# Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

Before 3.34.0, Fallow's glob expansion let a segment like `.*` match the parent-directory entry `..`, so a malicious repository could check whether files outside the project root exist. The attacker learns only existence (and a dependency path in trace output), not file contents, and must be able to read Fallow's output.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:fallow affected < 3.34.0 fixed 3.34.0
- npm:@fallow-cli/fallow-node affected < 3.34.0 fixed 3.34.0
- cargo:fallow-cli affected < 3.34.0 fixed 3.34.0
- cargo:fallow-config affected < 3.34.0 fixed 3.34.0
- cargo:fallow-core affected < 3.34.0 fixed 3.34.0

## How to check

- Run `fallow --version` (or check the `fallow` entry in `package-lock.json` / `Cargo.lock`) and confirm it is below `3.34.0`.
- Check whether the repositories you analyze with Fallow include untrusted plugin files whose `detection`, `configPatterns` or `alwaysUsed` patterns contain `.*`, `.?` or `..*`.

## Fix

- Upgrade `fallow` and `@fallow-cli/fallow-node` to `3.34.0`.
- Upgrade `fallow-cli`, `fallow-config` and `fallow-core` crates to `3.34.0`.
- Until upgraded, run Fallow only on repositories you trust.

## Timeline

- 2026-10-23T22:05:18+00:00 ghsa https://github.com/advisories/GHSA-h4fr-cmh5-qr62

## From the sources

### Impact

Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation.

The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root:

- A plugin `fileExists` detection pattern such as `.*/marker.json` made the plugin active when `marker.json` existed in the parent directory.
- An external plugin `configPatterns` or `alwaysUsed` pattern could match a config file in the parent directory. When the plugin was active and declared `toolingDependencies`, the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and `--trace-dependency` printed the outside path.
- `fallow plugin-check` reported `path_exists: true` for a seeded entry that matched only in the parent directory.

Fallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs.

The Jest, Vitest and Rstest project globs had the same `.*` problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case.

### Patches

Fixed in 3.34.0. Fallow now rewrites a leading `.` in a wildcard segment to `[.]` before it expands the glob on disk. `[.]` matches the same hidden files and directories inside the project root. The `glob` crate does not test `..` against it.

### Workarounds

Run Fallow only on repositories that you trust. Before you run Fallow on another repository, check the `detection`, `configPatterns` and `alwaysUsed` patterns of its plugin files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_