Skip to content
OpenAdvisories

Product · @fallow-cli

fallow-node

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.3
    CVE-2026-115569

    Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

    Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. …

    fallow-rs @fallow-cli fallow-cli fallow npm crates.io