CVE-2026-115569
4 advisories.
npm/fallow CVE-2026-115569: low 3.3
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Action: Upgrade fallow to 3.34.0 or later.
npm i fallow@3.34.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.68.0 | 3.34.0 | - |
Fixed versions
| 3.34.0 |
Sources
- osv: GHSA-jfwm-3p3c-6hx5
- https://github.com/fallow-rs/fallow/security/advisories/GHSA-jfwm-3p3c-6hx5
- https://nvd.nist.gov/vuln/detail/CVE-2026-115569
- https://github.com/fallow-rs/fallow/pull/3556
- https://github.com/fallow-rs/fallow/commit/75c0c60948a53ddfe042e65b446343989f4c5649
- https://github.com/fallow-rs/fallow
- https://github.com/fallow-rs/fallow/releases/tag/v3.34.0
CVE-2026-115569 · published · modified · JSON
npm/@fallow-cli/fallow-node CVE-2026-115569: low 3.3
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Action: Upgrade @fallow-cli/fallow-node to 3.34.0 or later.
npm i @fallow-cli/fallow-node@3.34.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.68.0 | 3.34.0 | - |
Fixed versions
| 3.34.0 |
Sources
- osv: GHSA-jfwm-3p3c-6hx5#npm/@fallow-cli/fallow-node
- https://github.com/fallow-rs/fallow/security/advisories/GHSA-jfwm-3p3c-6hx5
- https://nvd.nist.gov/vuln/detail/CVE-2026-115569
- https://github.com/fallow-rs/fallow/pull/3556
- https://github.com/fallow-rs/fallow/commit/75c0c60948a53ddfe042e65b446343989f4c5649
- https://github.com/fallow-rs/fallow
- https://github.com/fallow-rs/fallow/releases/tag/v3.34.0
CVE-2026-115569 · published · modified · JSON
crates.io/fallow-cli CVE-2026-115569: low 3.3
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Action: Upgrade fallow-cli to 3.34.0 or later.
cargo update -p fallow-cli --precise 3.34.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.68.0 | 3.34.0 | - |
Fixed versions
| 3.34.0 |
Sources
- osv: GHSA-jfwm-3p3c-6hx5#crates.io/fallow-cli
- https://github.com/fallow-rs/fallow/security/advisories/GHSA-jfwm-3p3c-6hx5
- https://nvd.nist.gov/vuln/detail/CVE-2026-115569
- https://github.com/fallow-rs/fallow/pull/3556
- https://github.com/fallow-rs/fallow/commit/75c0c60948a53ddfe042e65b446343989f4c5649
- https://github.com/fallow-rs/fallow
- https://github.com/fallow-rs/fallow/releases/tag/v3.34.0
CVE-2026-115569 · published · modified · JSON
crates.io/fallow-core CVE-2026-115569: low 3.3
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Action: Upgrade fallow-core to 3.34.0 or later.
cargo update -p fallow-core --precise 3.34.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.68.0 | 3.34.0 | - |
Fixed versions
| 3.34.0 |
Sources
- osv: GHSA-jfwm-3p3c-6hx5#crates.io/fallow-core
- https://github.com/fallow-rs/fallow/security/advisories/GHSA-jfwm-3p3c-6hx5
- https://nvd.nist.gov/vuln/detail/CVE-2026-115569
- https://github.com/fallow-rs/fallow/pull/3556
- https://github.com/fallow-rs/fallow/commit/75c0c60948a53ddfe042e65b446343989f4c5649
- https://github.com/fallow-rs/fallow
- https://github.com/fallow-rs/fallow/releases/tag/v3.34.0
CVE-2026-115569 · published · modified · JSON