CVE-2026-115569: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fallowto a version that resolves this vulnerability.Fixed in 3.34.0
Event History
Frequently Asked Questions
Which configuration paths can cause Fallow to read outside the repository root?
Affected Jest projects paths can escape through absolute paths, parent-directory segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, Vitest test.projects paths, inline-project extends paths, and symlinked script --config paths are also affected.
What access does an attacker need to influence the analysis?
The attacker needs to control relevant test-runner configuration paths in a repository that Fallow analyzes. The issue is local and requires user interaction, such as running Fallow against that repository.
What is the practical impact if exploitation succeeds?
Fallow parses the external files as test-runner configuration and may credit dependencies, setup files, and JSX import sources based on them. This can alter unused-dependency and unused-file findings in CI or agent analysis, but the external file contents are not printed or sent over the network.
What remediation is available?
Upgrade Fallow to version 3.34.0, which fixes the issue.