Skip to content
OpenAdvisories

Package · crates.io

fallow-cli

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.3
    GHSA-h4fr-cmh5-qr62

    Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

    ### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. F…

    fallow fallow-cli fallow-core @fallow-cli/fallow-node npm crates.io
  • Low 3.3
    CVE-2026-115569

    Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

    Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. …

    fallow-rs @fallow-cli fallow-cli fallow npm crates.io