CVE-2026-115569 in fallow-cli
Summary
by MITRE • 10/23/2026
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified as CVE-2024-51748 affects Fallow, a codebase intelligence tool designed for analyzing TypeScript and JavaScript projects. The core of this security flaw lies in the application's path resolution logic during the analysis phase. Specifically, versions ranging from 2.68.0 up to but not including 3.34.0 exhibit an improper restriction of pathname traversal when processing test runner configurations. This allows the tool to follow absolute paths, parent directory segments such as double dots in relative paths, dot-prefixed wildcard globs, and symbolic links that point outside the designated project root directory. In version 3.33.1, this behavior was also extended to include Vitest test projects paths, inline-project extends paths, and symlinked script configuration paths. This lack of strict boundary enforcement enables an attacker who controls the local file system structure or can inject specific path configurations into a Jest or Vitest project to direct Fallow to read arbitrary files located outside the intended scope of the analysis.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal. The operational impact stems from how Fallow utilizes these external file contents. Once the tool accesses files outside the project root through these manipulated paths, it parses them as part of the test-runner configuration. This parsing process influences downstream analysis outcomes by altering findings related to unused dependencies and unused files within CI pipelines or agent-based static analysis environments. An attacker could potentially manipulate these results to hide malicious code changes, introduce false positives regarding dependency usage, or disrupt automated security workflows that rely on accurate reports from Fallow. Although the vulnerability allows for unauthorized file reading relative to the project boundary, it is important to note that the contents of these outside files are not printed to standard output nor transmitted over the network, which limits the immediate risk of direct data exfiltration but still poses a significant threat to the integrity and reliability of automated code analysis processes.
This issue aligns with ATT&CK technique T1083: File and Directory Discovery, as it involves accessing files outside an expected directory structure without proper authorization or context validation. The vulnerability highlights the risks associated with tools that perform deep static analysis on user-controlled project configurations where path resolution is not strictly sandboxed to the source tree. To mitigate this risk, organizations using Fallow must ensure they are operating on version 3.34.0 or later, which contains the necessary patches to enforce strict directory boundaries during configuration parsing. For environments that cannot immediately upgrade, it is advisable to restrict file system permissions for the user running the analysis tool and to audit Jest and Vitest configurations for any use of absolute paths or symlinks pointing outside the project root until the update can be applied.