Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.34.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Fallow, a TypeScript and JavaScript codebase analysis tool, is affected through its handling of Jest and Vitest project configuration paths. A maliciously crafted repository can make Fallow read configuration files outside the project directory, which can alter its unused dependency and unused file results in CI or automated analysis, though the external file contents are not exposed or transmitted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- fallow-rs fallow
From 2.68.0 · fixed in 3.34.0
- @fallow-cli fallow-node
From 2.68.0 · fixed in 3.34.0
- fallow-rs fallow-cli
From 2.68.0 · fixed in 3.34.0
- fallow-rs fallow-core
From 2.68.0 · fixed in 3.34.0
- fallownpm
From 2.68.0 · fixed in 3.34.0
- @fallow-cli/fallow-nodenpm
From 2.68.0 · fixed in 3.34.0
- fallow-clicrates.io
From 2.68.0 · fixed in 3.34.0
- fallow-corecrates.io
From 2.68.0 · fixed in 3.34.0