Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Impact
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused…
Source excerpt · GitHub_MAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
fallow-rs · GitHub_M
fallow
1 range
fallow-rs · GitHub_M
fallow
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 2.68.0, < 3.34.0
Other versions: unknown
@fallow-cli · GitHub_M
fallow-node
1 range
@fallow-cli · GitHub_M
fallow-node
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 2.68.0, < 3.34.0
Other versions: unknown
fallow-rs · GitHub_M
fallow-cli
1 range
fallow-rs · GitHub_M
fallow-cli
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 2.68.0, < 3.34.0
Other versions: unknown
fallow-rs · GitHub_M
fallow-core
1 range
fallow-rs · GitHub_M
fallow-core
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 2.68.0, < 3.34.0
Other versions: unknown
Original source description
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115569View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.