{"action":"Upgrade fallow-config to 3.34.0 or later.","affected":[{"fixed":"3.34.0","introduced":"0"}],"component":"fallow-config","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["3.34.0"],"ghsa_id":"GHSA-h4fr-cmh5-qr62","id":"tcs_01M5NDPXJ5926YTA22A04M9ZP3","modified_at":"2026-10-23T22:15:05.376415931Z","published_at":"2026-10-23T21:58:16Z","references":["https://osv.dev/vulnerability/GHSA-h4fr-cmh5-qr62","https://github.com/fallow-rs/fallow/security/advisories/GHSA-h4fr-cmh5-qr62","https://github.com/fallow-rs/fallow/pull/3548","https://github.com/fallow-rs/fallow/commit/133d4c862c74f4b1f0a7417c65b7157c1144294d","https://github.com/fallow-rs/fallow","https://github.com/fallow-rs/fallow/releases/tag/v3.34.0"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-h4fr-cmh5-qr62#crates.io/fallow-config","url":"https://osv.dev/vulnerability/GHSA-h4fr-cmh5-qr62"}],"summary":"Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root"}