fallow vulnerabilities

CVEs whose affected-version data names the fallow package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-115569Low· 3.3

today

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcar…

▾ Sunlitfallow-rs · fallowvia CVEORG