Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

影響: npm:fallow >= 2.68.0, < 3.34.0 → 3.34.0, npm:@fallow-cli/fallow-node >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-cli >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-core >= 2.68.0, < 3.34.0 → 3.34.0

Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example /etc/; - a path with .. segments, for example ../; - a glob with a . segment, because the glob crate also tests .. against a segment that starts with a liter…

Read on GitHub Advisory Database

On 10/24/2026, 06:57 AM, GitHub Advisory Database published "Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js, Rust. CVE: CVE-2026-115569.