GHSA-5g3j-89fr-r2vp

Source

https://github.com/advisories/GHSA-5g3j-89fr-r2vp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5g3j-89fr-r2vp/GHSA-5g3j-89fr-r2vp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5g3j-89fr-r2vp

Published

2026-04-08T00:07:36Z

Modified

2026-04-08T00:23:44.063270Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

skilleton has improper input handling in repository/path processing

Details

Summary

skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic.
Version 0.3.1 contains fixes and additional test coverage for these issues.

Affected Versions

<0.3.1

Patched Versions

>=0.3.1

Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.
0.3.1 mitigates this by: - replacing vulnerable parsing behavior with deterministic logic, - validating subpaths earlier before allocating git worktree resources, - adding stricter and broader regression tests around these flows.

Severity

Low to Moderate (project-maintainer assessed)

Mitigation

Upgrade to 0.3.1 or later.

Workarounds

No complete workaround is recommended other than upgrading.

References

Branch: fix/security-code-scanning-alerts
Commits:
- fix(security): harden git arg handling and path validation
- fix(security): use while loop in normalizeRepoUrl instead of regex
Security Policy: SECURITY.md

Credits

Detected through automated code scanning and remediated by project maintainers.

Database specific

{
    "github_reviewed_at": "2026-04-08T00:07:36Z",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-1333",
        "CWE-400",
        "CWE-78",
        "CWE-88"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

npm / skilleton

Package

Name: skilleton; View open source insights on deps.dev
Purl: pkg:npm/skilleton

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5g3j-89fr-r2vp/GHSA-5g3j-89fr-r2vp.json"