Fallow Path Traversal Flaws Let Analyzed Repositories Reach Files Outside the Project Root

What happened

Two separate advisories describe how Fallow could be made to access files outside the boundaries of the project it is analyzing. In the first issue (CVE-2026-115569 / GHSA-jfwm-3p3c-6hx5), Fallow followed attacker-controlled Jest 'projects' paths outside the project root using absolute paths, parent directory segments, dot-prefixed wildcard globs, or symlinks. A related variant also affected Vitest 'test.projects' paths, Vitest inline-project 'extends' paths, and symlinked script '--config' paths. The outside files were parsed as test-runner configuration and used to credit dependencies, setup files, and JSX import sources, which could alter unused-dependency and unused-file findings produced by Fallow during CI or agent-driven analysis. The second issue (GHSA-h4fr-cmh5-qr62) found that a glob segment such as '.*' , '.?', or '..*' could also match the special '..' parent-directory entry, because the underlying glob matching library tests '..' against any segment starting with a literal dot. Although Fallow validates plugin glob patterns and explicitly rejects absolute paths and '..' segments, these dot-prefixed wildcard segments bypassed that validation and let a plugin pattern test for the existence of files or directories in the parent of the project root.

Technical cause

Both issues are classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The first issue stems from Fallow trusting test-runner configuration paths (Jest and Vitest 'projects'/'extends' entries, and symlinked '--config' paths) supplied from within an analyzed repository, without sufficiently restricting them to the project root. The second issue is a validation gap: Fallow's glob-based plugin detection logic rejects literal '..' segments, but a wildcard segment beginning with a dot (for example '.*') could still expand to match the '..' entry in the underlying glob library, effectively achieving the same parent-directory traversal through a pattern that passed validation.

Why it matters

Fallow is designed to analyze third-party or external repositories, which means the repository content itself is attacker-controlled input. These flaws allowed that content to influence Fallow's analysis of files outside the intended project boundary. In the Jest/Vitest case, this could change Fallow's unused-dependency and unused-file findings in CI pipelines or agent-driven analysis. In the glob case, an attacker who can also read Fallow's output (for example a CI log or pull request comment) could learn whether a specific file or directory exists in the parent of the project root, and in some configurations cause an unused dependency finding to disappear or have '--trace-dependency' print the outside path.

Who is affected

Users of the npm packages 'fallow' and '@fallow-cli/fallow-node' who run Fallow against repositories they do not fully trust are affected, particularly in CI pipelines or automated agent workflows that analyze external or third-party codebases.

Affected versions

For CVE-2026-115569 / GHSA-jfwm-3p3c-6hx5, 'fallow' and '@fallow-cli/fallow-node' versions from 2.68.0 up to (but not including) 3.34.0 are affected by the Jest 'projects' path issue; the advisory also notes that in version 3.33.1 the same behavior additionally affected Vitest 'test.projects' paths, Vitest inline-project 'extends' paths, and symlinked script '--config' paths. For GHSA-h4fr-cmh5-qr62, all versions prior to 3.34.0 are affected by the glob wildcard traversal issue.

Fixes and mitigation

Both issues are fixed in version 3.34.0 of 'fallow' and '@fallow-cli/fallow-node'. For the glob wildcard issue, the fix rewrites a leading dot in a wildcard glob segment so it no longer matches the parent directory entry during on-disk expansion, while still matching hidden files and directories inside the project root. As a workaround prior to upgrading, the advisory recommends running Fallow only on repositories you trust, and reviewing the detection, configPatterns, and alwaysUsed patterns of a repository's plugin files before running Fallow on it.

Recommended action

Upgrade 'fallow' and '@fallow-cli/fallow-node' to version 3.34.0 or later. Until the upgrade is applied, limit Fallow analysis to trusted repositories and review plugin pattern files (detection, configPatterns, alwaysUsed) in untrusted repositories before running Fallow against them.