Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

影響: npm:fallow >= 2.68.0, < 3.34.0 → 3.34.0, npm:@fallow-cli/fallow-node >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-cli >= 2.68.0, < 3.34.0 → 3.34.0, rust:fallow-core >= 2.68.0, < 3.34.0 → 3.34.0

Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example /etc/; - a path with .. segments, for example ../; - a glob with a . segment, because the glob crate also tests .. against a segment that starts with a liter…

在 GitHub Advisory Database 阅读

2026/10/24 06:57，GitHub Advisory Database 发布了“Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js、Rust。CVE：CVE-2026-115569。