CVE-2026-115569 Details

A vulnerability exists in the Fallow codebase intelligence tool for TypeScript and JavaScript, specifically in versions 2.68.0 prior to 3.34.0. The issue arises because Fallow improperly handles project configuration paths for Jest and Vitest, allowing it to read files outside the project root. This can occur through absolute paths, parent directory segments, dot-prefixed wildcard globs, or symlinks. When Fallow reads these external files, it interprets them as test runner configurations, which can inadvertently alter the analysis results regarding unused dependencies and files. Although the contents of the external files are not disclosed or transmitted over the network, this vulnerability could lead to unexpected changes in the codebase analysis, particularly in continuous integration (CI) environments or when using Fallow as a GitHub agent.

Users can upgrade to Fallow version 3.34.0 or later, where this vulnerability is fixed. In version 3.34.0, Fallow was updated to ensure that it only reads configuration files from paths that are within the project root. The update also addresses the issue of symlinks pointing to directories above the project root.