Fallow Path Traversal Vulnerability in Jest/Vitest Config Parsing

Fallow versions 2.68.0 to 3.33.1 could read files outside the project root through malicious Jest and Vitest configuration entries, potentially allowing crafted repositories to manipulate analysis findings when run in CI or by automated agents.

Disclosed 23 October 2026 · Record updated 23 October 2026

Impact

Crafted repositories could cause Fallow to read configuration files outside the project root, changing dependency and file analysis findings without exposing file contents.

Our coverage

A robot scanning files stops at a fence marking the project boundary, but a winding path carved in the ground lures it backward toward a locked cabinet beyond.

Vulnerabilities

Fallow read files outside project root via test configs

A path traversal flaw in the code analysis tool let a crafted repository steer it into reading files beyond the project it was told to scan.

23 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-jfwm-3p3c-6hx5