CVE-2026-115569

Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0.

• CWE-22
• CWE-59

• https://github.com/fallow-rs/fallow/commit/75c0c60948a53ddfe042e65b446343989f4c5649
• https://github.com/fallow-rs/fallow/pull/3556
• https://github.com/fallow-rs/fallow/releases/tag/v3.34.0
• https://github.com/fallow-rs/fallow/security/advisories/GHSA-jfwm-3p3c-6hx5

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115546Okta Access Gateway (OAG) does not validate the selected aut…8.1
• CVE-2026-115547An input validation issue in the Okta Access Gateway (OAG) A…9.1
• CVE-2026-11555A vulnerability was identified in D-Link DGS-1100-08PD 1.00.…7.5
• CVE-2026-115557Python has added a denylist for known compromised certificat…9.4
• CVE-2026-11556A security flaw has been discovered in Tenda F451 1.0.0.7/1.…8.8
• CVE-2026-115567Tokio is a runtime for writing applications with Rust. In 1.…5.8
• CVE-2026-11557A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9…8.8
• CVE-2026-115570Electron is a framework for writing cross-platform desktop a…7.4
• CVE-2026-115572pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-11558A security vulnerability has been detected in CodeAstro Payr…6.3
• CVE-2026-115580pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-115585pypdf is a free and open-source pure-python PDF library. Pri…7.1