## Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

- 種別: advisory
- 重大度: low
- 関連技術: nodejs, rust
- CVE: CVE-2026-115569
- 公開日時: 2026-10-23T21:57:37.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-jfwm-3p3c-6hx5)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-jfwm-3p3c-6hx5

影響: npm:fallow >= 2.68.0, < 3.34.0 → 3.34.0, npm:@fallow-cli/fallow-node >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-cli >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-core >= 2.68.0, < 3.34.0 → 3.34.0
Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example /etc/; - a path with .. segments, for example ../; - a glob with a . segment, because the glob crate also tests .. against a segment that starts with a liter…