fallow-cli vulnerabilities

Products

• @fallow-cli/fallow-node 2

Latest fallow-cli CVEs

Newest publication first

1. GHSA-h4fr-cmh5-qr62 Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

   Published 2026-10-23

   Low·CVSS 3.3

   Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as .*, .? or ..* in such a glob also matched the special .. entry. The glob crate tests .. against a segment that starts with a literal .. Fallow validates plugin glob patterns an...

2. CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

   Published 2026-10-23

   Low·CVSS 3.3

   Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.