Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Low 3.3

In plain English

A low-severity path traversal in fallow-node from @fallow-cli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 91.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@fallow-cli/fallow-node3.34.0GHSA-jfwm-3p3c-6hx5
npmfallow3.34.0GHSA-jfwm-3p3c-6hx5

Affected products (as reported)

VendorProductVersions
fallow-rs fallow >= 2.68.0, < 3.34.0
@fallow-cli fallow-node >= 2.68.0, < 3.34.0
fallow-rs fallow-cli >= 2.68.0, < 3.34.0
fallow-rs fallow-core >= 2.68.0, < 3.34.0

Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References