Threats affecting pkg:github/fallow-rs/fallow

CVE-2026-115569 is a path traversal vulnerability in the fallow-rs fallow codebase intelligence tool for TypeScript and JavaScript. Versions from 2.68.0 up to but not including 3.34.0 allow attacker-controlled Jest and Vitest project paths to reference files outside the project root via absolute paths, parent directory segments, wildcard globs, or symlinks. This causes fallow to parse external files as test-runner configurations, potentially affecting dependency and file usage analysis. The vulnerability does not expose file contents externally. The issue is fixed in version 3.34.0.