Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

影響: npm:fallow >= 2.68.0, < 3.34.0 → 3.34.0, npm:@fallow-cli/fallow-node >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-cli >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-core >= 2.68.0, < 3.34.0 → 3.34.0

Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example /etc/; - a path with .. segments, for example ../; - a glob with a . segment, because the glob crate also tests .. against a segment that starts with a liter…

GitHub Advisory Databaseで読む

2026/10/24 06:57、GitHub Advisory Databaseが「Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js、Rust。CVE: CVE-2026-115569。