2vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low2 (100.0%)
fallow
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 2LowAffects 2 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 2
Vulnerabilities (2)
Known vulnerabilities affecting fallow, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-h4fr-cmh5-qr62 | Low | Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation. The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in |
| GitHub (opens in a new tab) | |
| GHSA-jfwm-3p3c-6hx5 | Low | Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example `/etc/*`; - a path with `..` segments, for example `../*`; - a glob with a `.*` segment, because the `glob` crate also tests `..` against a segment that starts with a literal `.`; - a symlink in the project root to a directory above it; - th |
| GitHub (opens in a new tab) |
- GHSA-h4fr-cmh5-qr62LowFallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
< 3.34.0
### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?` or `..*` in such a glob also matched the special `..` entry. The `glob` crate tests `..` against a segment that starts with a literal `.`. Fallow validates plugin glob patterns and refuses absolute paths and `..` segments, but these segments passed that validation. The attacker controls the repository content. The attacker must also be able to read the Fallow output, for example a CI log or a pull request comment. Then the attacker can learn if a file or directory exists in
- GHSA-jfwm-3p3c-6hx5LowFallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
>= 2.68.0, < 3.34.0
### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vitest `test.projects` entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outside the root: - an absolute path or glob, for example `/etc/*`; - a path with `..` segments, for example `../*`; - a glob with a `.*` segment, because the `glob` crate also tests `..` against a segment that starts with a literal `.`; - a symlink in the project root to a directory above it; - th
CVE: CVE-2026-115569