Read the docs
TI-2026-79969 Aliases CVE-2026-115569GHSA-jfwm-3p3c-6hx5

Fallow Jest and Vitest project paths read files outside project root

Priority LOW 15CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Fallow from 2.68.0 before 3.34.0 follows attacker-controlled Jest projects paths, and in version 3.33.1 also Vitest test.projects paths, to files outside the project root. A missing path restriction (CWE-22) lets a repository make Fallow parse those outside files as test-runner configuration. An attacker who controls an analyzed repository can change unused dependency and unused file findings in CI or agent analysis, while the outside file contents are not printed or sent over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00187 8th percentileScored 2026-11-07
Fix Fixed fallow (fallow-rs): 3.34.0fallow-node (@fallow-cli): 3.34.0+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fallow-rsfallow2.68.0 to before 3.34.03.34.0Patch availableCNA
@fallow-clifallow-node2.68.0 to before 3.34.03.34.0Patch availableCNA
fallow-rsfallow-cli2.68.0 to before 3.34.03.34.0Patch availableCNA
fallow-rsfallow-core2.68.0 to before 3.34.03.34.0Patch availableCNA
—fallow (npm)2.68.0 to before 3.34.03.34.0Patch availableGHSA-jfwm-3p3c-6hx5
—@fallow-cli/fallow-node (npm)2.68.0 to before 3.34.03.34.0Patch availableGHSA-jfwm-3p3c-6hx5
—fallow-cli (crates.io)2.68.0 to before 3.34.03.34.0Patch availableGHSA-jfwm-3p3c-6hx5
—fallow-core (crates.io)2.68.0 to before 3.34.03.34.0Patch availableGHSA-jfwm-3p3c-6hx5
  • fallow Vendorfallow-rs Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available CNA
  • fallow-node Vendor@fallow-cli Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available CNA
  • fallow-cli Vendorfallow-rs Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available CNA
  • fallow-core Vendorfallow-rs Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available CNA
  • fallow (npm) Vendor— Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available GHSA-jfwm-3p3c-6hx5
  • @fallow-cli/fallow-node (npm) Vendor— Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available GHSA-jfwm-3p3c-6hx5
  • fallow-cli (crates.io) Vendor— Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available GHSA-jfwm-3p3c-6hx5
  • fallow-core (crates.io) Vendor— Affected 2.68.0 to before 3.34.0 Fixed in 3.34.0 Patch available GHSA-jfwm-3p3c-6hx5

Remediation

Upgrade fallow and @fallow-cli/fallow-node on npm, and fallow-cli and fallow-core on crates.io, to version 3.34.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA fallow (fallow-rs) Fixed in 3.34.0
  • Fix · CNA fallow-node (@fallow-cli) Fixed in 3.34.0
  • Fix · CNA fallow-cli (fallow-rs) Fixed in 3.34.0
  • Fix · CNA fallow-core (fallow-rs) Fixed in 3.34.0
  • Fix · GHSA-jfwm-3p3c-6hx5 fallow (npm) Fixed in 3.34.0 Advisory →
  • Fix · GHSA-jfwm-3p3c-6hx5 @fallow-cli/fallow-node (npm) Fixed in 3.34.0 Advisory →
  • Fix · GHSA-jfwm-3p3c-6hx5 fallow-cli (crates.io) Fixed in 3.34.0 Advisory →
  • Fix · GHSA-jfwm-3p3c-6hx5 fallow-core (crates.io) Fixed in 3.34.0 Advisory →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115569
  2. 2026-10-23 Alias added: GHSA-jfwm-3p3c-6hx5
  3. 2026-10-23 Fix available: crates.io/[email protected], crates.io/[email protected], npm/@fallow-cli/[email protected] +1 · GHSA-jfwm-3p3c-6hx5
  4. 2026-10-23 CVSS score added · GHSA-jfwm-3p3c-6hx5
  5. 2026-10-23 Weakness changed · GHSA-jfwm-3p3c-6hx5
  6. 2026-10-23 6 new references · GHSA-jfwm-3p3c-6hx5
  7. 2026-10-30 CISA SSVC decision points changed

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences