{"id":"ghsa-ghsa-jfwm-3p3c-6hx5","seq":661303,"kind":"advisory","title":"Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root","url":"https://github.com/advisories/GHSA-jfwm-3p3c-6hx5","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jfwm-3p3c-6hx5","summary":"影響: npm:fallow >= 2.68.0, < 3.34.0 → 3.34.0, npm:@fallow-cli/fallow-node >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-cli >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-core >= 2.68.0, < 3.34.0 → 3.34.0\nFallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example /etc/; - a path with .. segments, for example ../; - a glob with a . segment, because the glob crate also tests .. against a segment that starts with a liter…","severity":"low","techs":["nodejs","rust"],"cves":["CVE-2026-115569"],"tags":["GHSA-jfwm-3p3c-6hx5","fallow","@fallow-cli/fallow-node","fallow-cli","fallow-core"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:57:37.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}