Advisories for Cargo/Fallow-Cli package

Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: an absolute path or glob, for example /etc/; a path with .. segments, for example ../; …

Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as ., .? or .. in such a glob also matched the special .. entry. The glob crate tests .. against a segment that starts with a literal .. Fallow validates plugin glob patterns and refuses absolute paths and .. segments, but these segments passed that validation. The attacker controls the repository content. The attacker …