CVE-2026-115569: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in fallow-rs fallow

Fallow versions >=2.68.0 and <3.34.0 improperly limit pathname resolution, allowing path traversal through Jest and Vitest project paths and symlinked configuration scripts. This enables an attacker to cause fallow to parse files outside the intended project root directory as test-runner configurations. While the external file contents are not disclosed or transmitted, their parsing can alter the tool's analysis results, such as crediting dependencies or setup files incorrectly. The vulnerability is addressed in version 3.34.0.

The vulnerability allows an attacker to influence fallow's analysis by causing it to parse configuration files outside the project root. This can modify findings related to unused dependencies and files in continuous integration or agent analysis environments. There is no direct confidentiality, integrity, or availability impact on the system beyond the altered analysis results. No file contents are leaked or sent over the network.

Upgrade fallow to version 3.34.0 or later, where this path traversal issue is fixed. No other mitigations are indicated or required according to the available data.