ZDF
Sign inSign up

Vulnerabilities

Security fix · GHSA-h4fr-cmh5-qr62

Fallow: A glob segment let an analyzed repository make Fallow test paths in the parent of the project root

Published Oct 23, 2026 · catalog updated Oct 23, 2026 · Fallow: A glob segment

Last checked Oct 24, 2026, 12 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-h4fr-cmh5-qr62. A missing EPSS score is not a low risk. Compare Fallow: A glob segment with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Fallow: A glob segment).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Low3.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Version ranges on file
Affected products
crates.io fallow-cli · crates.io fallow-config · crates.io fallow-core · npm @fallow-cli/fallow-node · npm fallow · rust fallow-cli

### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as , or in such a glob also matched the special entry. The crate tests against a segment that starts with a literal . Fallow validates plugin glob patterns and refuses absolute paths and segments, but these segments passed that validation. The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root: - A plugin detection pattern such as made the plugin active when existed in the parent directory. - An external plugin or pattern could match a config file in the parent directory. When the plugin was active and declared , the tooling detection credited the related dev dependency. An unused dependency finding could then disappear, and printed the outside path. - reported for a seeded entry that matched only in the parent directory. Fallow tested only that these paths exist. It did not read or print the content of a file outside the project root through these globs. The Jest, Vitest and Rstest project globs had the same problem, and the Jest and Vitest ones also read file content. GHSA-jfwm-3p3c-6hx5 describes that case. ### Patches Fixed in 3.34.0. Fallow now rewrites a leading in a wildcard segment to before it expands the glob on disk. matches the same hidden files and directories inside the project root. The crate does not test against it. ### Workarounds Run Fallow only on repositories that you trust. Before you run Fallow on another repository, check the , and patterns of its plugin files.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • crates.io fallow-cli0 → 3.34.0
  • crates.io fallow-config0 → 3.34.0
  • crates.io fallow-core0 → 3.34.0
  • npm @fallow-cli/fallow-node0 → 3.34.0
  • npm @fallow-cli/fallow-node< 3.34.0
  • npm fallow0 → 3.34.0
  • npm fallow< 3.34.0
  • rust fallow-cli< 3.34.0
  • rust fallow-config< 3.34.0
  • rust fallow-core< 3.34.0

How to fix GHSA-h4fr-cmh5-qr62

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-h4fr-cmh5-qr62. A missing EPSS score is not a low risk. Compare Fallow: A glob segment with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 3.34.0, < 3.34.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · GitHub Advisory Database

    Detected

    ### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as , or in such a glob also matched the special entry. The crate tests against a segment that starts with a literal . Fallow validates plugin glob patterns and refuses absolute paths and segments, but these segments passed that validation. The attacker controls the repository content. The attac

  2. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    fallow fixed in 3.34.0; @fallow-cli/fallow-node fixed in 3.34.0; fallow-cli fixed in 3.34.0; fallow-config fixed in 3.34.0

  3. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    fallow fixed in 3.34.0

  4. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    @fallow-cli/fallow-node fixed in 3.34.0

  5. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    fallow-cli fixed in 3.34.0

  6. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    fallow-config fixed in 3.34.0

  7. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    fallow-core fixed in 3.34.0

  8. Oct 23, 2026 · GitHub Advisory Database

    Updated

    ### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as , or in such a glob also matched the special entry. The crate tests against a segment that starts with a literal . Fallow validates plugin glob patterns and refuses absolute paths and segments, but these segments passed that validation. The attacker controls the repository content. The attac

Sources

  • GitHub Advisory DatabasePackage advisoryGHSA-h4fr-cmh5-qr62

    Fallow: A glob segment let an analyzed repository make Fallow test paths in the parent of the project root

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-h4fr-cmh5-qr62

    Fallow: A glob segment let an analyzed repository make Fallow test paths in the parent of the project root

    osv.dev

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 24, 2026
  • OpenSSF OSV / OSV ScannerOct 24, 2026