Fallow read files outside project root via test configs

Fallow, a code analysis tool, has patched a path traversal flaw that let an analysed repository make the tool read files outside the project root. The advisory, GHSA-jfwm-3p3c-6hx5, was published on 23 October 2026 and carries the identifier CVE-2026-115569. Versions 2.68.0 through 3.33.1 are affected, and the fix landed in version 3.34.0.

According to the advisory, Fallow reads the Jest and Vitest configuration files of whatever repository it analyses. A Jest projects entry, or a Vitest test.projects entry, can name a path to another config file. Fallow followed those entries and read the file they pointed at, even when that file sat outside the project directory.

Several forms of entry reached outside the root, the advisory said. An absolute path or glob such as /etc/* worked. So did a path containing .. segments. A glob with a .* segment also escaped, because the glob crate used by Fallow tests .. against any segment beginning with a literal dot. A symlink in the project root pointing to a directory above it had the same effect, as did the extends path of a Vitest inline project and a script --config path that was a symlink to a file outside the root. Versions 2.68.0 to 3.33.1 were exposed through the Jest projects route; version 3.33.1 also read outside files through Vitest test.projects.

The impact is limited. Fallow parsed each file it read as a test runner config and used the content only to credit dependencies, setup files and JSX import sources. The advisory states that Fallow did not print the file content and did not send it over the network. What an attacker gains, in the project's own words, is changed findings rather than the file content: reports of unused dependencies and unused files could shift.

The project frames this as a break in its stated threat model, which says analysis reads only inside the project root. A crafted repository could therefore make Fallow read files the user did not expect. The advisory singles out two settings where that matters: continuous integration pipelines, and cases where an agent runs Fallow on a repository it has cloned. In both, nobody is watching the file reads, and the repository under analysis is not necessarily trusted.

The patch changes how Fallow resolves matches. Each match is now resolved with symlinks followed and .. segments removed, and Fallow reads the result only if it lands inside the project root. A glob whose literal base sits outside the root does not run at all. The project says legitimate layouts still work: an in-root entry such as <rootDir>/../packages/* continues to resolve, including from the config of a workspace package. Fallow also no longer reads a script --config path that is a symlink to a file outside the project root.

For anyone who cannot upgrade immediately, the advisory recommends running Fallow only on repositories you trust, and checking the projects entries in jest.config.* and vitest.config.* files before running the tool against someone else's code.

The affected packages are npm fallow, npm @fallow-cli/fallow-node, and the Rust crates fallow-cli and fallow-core.