p PatchFirst

PatchFirst · Latest vulnerabilities

@fallow-cli/fallow-node vulnerabilities

Vulnerabilities published for @fallow-cli/fallow-node in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. GHSA-h4fr-cmh5-qr62

    Low · CVSS 3.3Fix available

    Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

    ### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation. The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in the parent of the project root: - A plugin `fileE

    @fallow-cli/fallow-nodeNode.js
    • Update to 3.34.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-115569

    Low · CVSS 3.3Fix available

    Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

    Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file c

    @fallow-cli/fallow-nodeNode.js
    • Update to 3.34.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →