Fallow, a TypeScript/JavaScript codebase intelligence tool, allows Jest and Vitest project definitions to reference absolute paths, parent segments, dot‑prefixed wildcard globs, or symlinks that traverse outside the intended project root. This enables Fallow to read and parse files that are not part of the repository and use those files as test‑runner configuration. The resulting configuration can alter dependency crediting and identify unused files in continuous integration or agent analysis, which is the primary impact. The vulnerability falls under the file‑and‑directory‑name‑injection class (CWE‑22) and path‑traversal (CWE‑59) weaknesses.

Affected systems are all Fallow distributions, including the Fallow Node implementation, the primary Fallow binary, the Fallow CLI component, and the underlying Fallow core library. Versions from 2.68.0 through 3.34.0 are impacted, with the latest releases before 3.34.0 also affected in the Vitest inline‑project configuration and symlinked script configuration paths.

Risk assessment: The CVSS score is 3.3, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local: an attacker must craft or modify the Jest or Vitest configuration files in a repository that Fallow processes. Because the vulnerability does not result in network disclosure or arbitrary code execution, exploitation is limited to manipulating analysis results and potentially revealing non‑public file contents to a local build or analysis environment.