{"action":"Upgrade fallow to 3.34.0 or later.","affected":[{"fixed":"3.34.0","introduced":"2.68.0"}],"component":"fallow","cve_ids":["CVE-2026-115569"],"ecosystem":"npm","epss":0.00187,"exploited":false,"fixed_versions":["3.34.0"],"ghsa_id":"GHSA-jfwm-3p3c-6hx5","id":"tcs_01M5NDPQYNM85R0M3D2BKCFBM9","modified_at":"2026-10-23T22:15:04.462997809Z","published_at":"2026-10-23T21:57:37Z","references":["https://osv.dev/vulnerability/GHSA-jfwm-3p3c-6hx5","https://github.com/fallow-rs/fallow/security/advisories/GHSA-jfwm-3p3c-6hx5","https://nvd.nist.gov/vuln/detail/CVE-2026-115569","https://github.com/fallow-rs/fallow/pull/3556","https://github.com/fallow-rs/fallow/commit/75c0c60948a53ddfe042e65b446343989f4c5649","https://github.com/fallow-rs/fallow","https://github.com/fallow-rs/fallow/releases/tag/v3.34.0"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-jfwm-3p3c-6hx5","url":"https://osv.dev/vulnerability/GHSA-jfwm-3p3c-6hx5"}],"summary":"Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root"}