{"action":"Upgrade fallow to 3.34.0 or later.","affected":[{"fixed":"3.34.0","introduced":"0"}],"component":"fallow","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["3.34.0"],"ghsa_id":"GHSA-h4fr-cmh5-qr62","id":"tcs_01M5NDPW6E3CFXKE6ESZPRSZPZ","modified_at":"2026-10-23T22:15:05.376415931Z","published_at":"2026-10-23T21:58:16Z","references":["https://osv.dev/vulnerability/GHSA-h4fr-cmh5-qr62","https://github.com/fallow-rs/fallow/security/advisories/GHSA-h4fr-cmh5-qr62","https://github.com/fallow-rs/fallow/pull/3548","https://github.com/fallow-rs/fallow/commit/133d4c862c74f4b1f0a7417c65b7157c1144294d","https://github.com/fallow-rs/fallow","https://github.com/fallow-rs/fallow/releases/tag/v3.34.0"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-h4fr-cmh5-qr62","url":"https://osv.dev/vulnerability/GHSA-h4fr-cmh5-qr62"}],"summary":"Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root"}