CVE-2026-115569

Name of the Vulnerable Software and Affected Versions Fallow versions 2.68.0 through 3.33.1

Description Fallow follows attacker-controlled paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. This behavior affects Jest projects paths and, starting from version 3.33.1, also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses these external files as test-runner configurations to credit dependencies, setup files, and JSX import sources. This can result in altered findings regarding unused dependencies and unused files during CI or agent analysis. The contents of the external files are not printed or transmitted over the network.

Recommendations Update Fallow to version 3.34.0. Run Fallow only on trusted repositories. Verify the projects entries in jest.config.* and vitest.config.* files before running the tool on a repository.