CVE-2026-115569

Fallow: Jest and Vitest projects entries let an analyzed repository make Fallow read files outside the project root

Workarounds

Run Fallow only on repositories that you trust. Before you run Fallow on another repository, check the projects entries of its jest.config.* and vitest.config.* files.

Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root:

• an absolute path or glob, for example /etc/*;
• a path with .. segments, for example ../*;
• a glob with a .* segment, because the glob crate also tests .. against a segment that starts with a literal .;
• a symlink in the project root to a directory above it;
• the extends path of a Vitest inline project;
• a script --config path that is a symlink to a file outside the project root.

Fallow parsed each of these files as a test runner config. Fallow used the content only to credit dependencies, setup files and JSX import sources. Thus unused dependency and unused file findings could change. Fallow did not print the content or send it over the network.

The Fallow threat model states that analysis reads only inside the project root. A crafted repository could make Fallow read files that the user did not expect. Such a read can happen in CI, or when an agent runs Fallow on a cloned repository. The attacker gets changed findings, not the file content.

Versions 2.68.0 to 3.33.1 read outside files through Jest projects. Version 3.33.1 also read them through Vitest test.projects.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2026-115569 has a CVSS score of 3.3 (Low). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.34.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Fixed in 3.34.0. Fallow now resolves each match with symlinks and .. segments removed. Fallow reads the match only when it is inside the project root. A glob whose literal base is outside the project root does not run. The boundary is the project root, so an in-root entry such as <rootDir>/../packages/* still works, also from the config of a workspace package. Fallow also does not read a script --config path that is a symlink to a file outside the project root.

1. What is CVE-2026-115569? CVE-2026-115569 is a low-severity path traversal vulnerability in fallow (npm), affecting versions >= 2.68.0, < 3.34.0. It is fixed in 3.34.0. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2026-115569? CVE-2026-115569 has a CVSS score of 3.3 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2026-115569?
   • fallow (npm) (versions >= 2.68.0, < 3.34.0)
   • @fallow-cli/fallow-node (npm) (versions >= 2.68.0, < 3.34.0)
   • fallow-cli (rust) (versions >= 2.68.0, < 3.34.0)
   • fallow-core (rust) (versions >= 2.68.0, < 3.34.0)
4. Is there a fix for CVE-2026-115569? Yes. CVE-2026-115569 is fixed in 3.34.0. Upgrade to this version or later.
5. Is CVE-2026-115569 exploitable, and should I be worried? Whether CVE-2026-115569 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-115569 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-115569?
   • Upgrade fallow to 3.34.0 or later
   • Upgrade @fallow-cli/fallow-node to 3.34.0 or later
   • Upgrade fallow-cli to 3.34.0 or later
   • Upgrade fallow-core to 3.34.0 or later

Other vulnerabilities in fallow