Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
影響: npm:fallow >= 2.68.0, < 3.34.0 → 3.34.0, npm:@fallow-cli/fallow-node >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-cli >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-core >= 2.68.0, < 3.34.0 → 3.34.0
Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example /etc/; - a path with .. segments, for example ../; - a glob with a . segment, because the glob crate also tests .. against a segment that starts with a liter…
| CVE | CVE-2026-115569 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 06:57, GitHub Advisory Database에서 "Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js, Rust. CVE: CVE-2026-115569.