Vulnerability feed

Executive summary

Fallow, a codebase analysis tool for TypeScript and JavaScript, had a flaw that let its Jest and Vitest project settings read config files located outside the project folder. The advisory describes this as a security issue but does not state a severity score, and the fix is included in the project's changes shown in the advisory.

Technical summary

The flaw is a path containment issue (reading files outside the intended root) in how Fallow resolves Jest projects entries, Vitest test.projects entries, Vitest inline project extends paths, and script --config paths. Preconditions include a project config that names an absolute path, a path with dot segments, a glob, or a symlink pointing outside the project root. The fix adds canonicalization-based checks so only files inside the project root are read, and glob base paths outside the root are skipped; the advisory's diff also adds a Jest glob escaping fix for directory names containing square brackets. Affected and fixed version numbers are not stated in the advisory, and no CVSS score is stated. No workarounds or detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/fallow-rs/fallow/commit/75c0…e65b446343989f4c5649

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affects

fallow-rs@fallow-cliFallowfallow-rs fallow@fallow-cli fallow-nodefallow-rs fallow-clifallow-rs fallow-coreFallow