Codebase Intelligence Tool Fallow Vulnerability in TypeScript and JavaScript
CVE-2026-115569
What is CVE-2026-115569?
The Fallow codebase intelligence tool for TypeScript and JavaScript contains a vulnerability that allows it to follow attacker-controlled Jest project paths outside the project root. This includes paths through absolute paths, parent directory segments, dot-prefixed wildcard globs, and symlinks. In versions 2.68.0 to 3.34.0, this behavior leads Fallow to parse these external paths as part of its test-runner configuration. Consequently, it may impact the findings regarding unused dependencies and files during continuous integration or agent analysis. Although the contents from external files are neither printed nor sent over the network, the issue can still lead to substantial security risks. The vulnerability was addressed in version 3.34.0.
Affected Version(s)
fallow >= 2.68.0, < 3.34.0
fallow-cli >= 2.68.0, < 3.34.0
fallow-core >= 2.68.0, < 3.34.0