GHSA-5g3j-89fr-r2vp

GHSA-5g3j-89fr-r2vp · skilleton has improper input handling in repository/path processing

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

## Summary `skilleton` versions prior to `0.3.1` include security-related weaknesses in repository normalization and path handling logic. Version `0.3.1` contains fixes and additional test coverage for these issues. ## Affected Versions `<0.3.1` ## Patched Versions `>=0.3.1` ## Impact In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths. `0.3.1` mitigates this by: - replacing vulnerable parsing behavior with deterministic logic, - validating subpaths earlier before allocating git worktree resources, - adding stricter and broader regression tests around these flows. ## Severity Low to Moderate (project-maintainer assessed) ## Mitigation Upgrade to `0.3.1` or later. ## Workarounds No complete workaround is recommended other than upgrading. ## References - Branch: [`fix/security-code-scanning-alerts`](https://github.com/Fcmam5/skilleton/pull/9) - Commits: - [fix(security): harden git arg handling and path validation](https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172) - [fix(security): use while loop in normalizeRepoUrl instead of regex](https://github.com/Fcmam5/skilleton/pull/9/changes/6613160803ec8655efee9a270eeaa767ad22da8b) - Security Policy: [SECURITY.md](https://github.com/Fcmam5/skilleton/blob/master/SECURITY.md) ## Credits Detected through automated code scanning and remediated by project maintainers.

CVSS 6.9 · Moyenne · Correctif disponible

Publication

2026-04-08T00:07:36Z

Mise à jour

2026-04-08T00:23:44.063270Z

Pile logicielle: node

Vérifiez votre serveur →