Fallow CVE-2024-11563: Path Traversal via Jest/Vitest projects entries

Vulnerability Overview Vulnerability Name: Jest and Vitest entries allow an analyzed repository to cause Fallow to read files outside the project root CVE ID: CVE-2024-11563 Severity: Medium (CVSS 3.1 / 10) Affected Versions: Versions 2.6.8 through 3.34.0 of and Vulnerability Description: Fallow reads a project's Jest and Vitest configuration files for analysis. A project's entry is a Vitest or Jest configuration item; Fallow reads the configuration file pointed to by this entry and extracts paths from it, which may lead to reading files outside the project root. Impact Scope Affected Packages: - - - - Affected Versions: 2.6.8 through 3.34.0 Impact Description: - Fallow reads a project's Jest and Vitest configuration files. - A project's entry is a Vitest or Jest configuration item; Fallow reads the configuration file pointed to by this entry and extracts paths from it, which may lead to reading files outside the project root. - These forms include: - Absolute paths or glob paths, e.g., - Relative paths, e.g., - Paths starting with , e.g., - Paths within the project root, e.g., - Paths pointing to Vitest or Jest configurations - Paths pointing to configuration files, e.g., Remediation Fixed Version: 3.34.1 Fix Details: - Fixed the issue where reads all matches for and entries. - now only reads matches located within the project root. - If a or path points outside the project root, it will not be read. - If a entry points to a path outside the project root, it will not be read. - If a entry points to a workspace path, it will not be read. Notes Run Fallow only on repositories you trust. If you do not trust another repository, inspect its and files.

Goal Reached Thanks to every supporter — we hit 100%!

Fallow CVE-2024-11563: Path Traversal via Jest/Vitest projects entries

More from this source