GHSA-5g3j-89fr-r2vp skilleton has improper input handling in repository/path processing
Crafted input in skilleton can trigger unsafe path processing behavior, potentially leading to resource exhaustion or logic errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5g3j-89fr-r2vp?
GHSA-5g3j-89fr-r2vp is a path traversal vulnerability in skilleton, published on 8 Apr 2026.
Official description
Summary
skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic.
Version 0.3.1 contains fixes and additional test coverage for these issues.
Affected Versions
<0.3.1
Patched Versions
>=0.3.1
Impact
In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.0.3.1 mitigates this by:
- replacing vulnerable parsing behavior with deterministic logic,
- validating subpaths earlier before allocating git worktree resources,
- adding stricter and broader regression tests around these flows.
Severity
Low to Moderate (project-maintainer assessed)
Mitigation
Upgrade to 0.3.1 or later.
Workarounds
No complete workaround is recommended other than upgrading.
References
- Branch:
fix/security-code-scanning-alerts - Commits:
- Security Policy: SECURITY.md
Credits
Detected through automated code scanning and remediated by project maintainers.
Which versions are affected by GHSA-5g3j-89fr-r2vp?
2 open source packages ship an affected version, including skilleton.
| Package | Affected | Fixed in |
|---|---|---|
skilleton npm | All versions | 0.3.1 |
skilleton npm | All versions | 0.3.1 |
How do I fix GHSA-5g3j-89fr-r2vp?
Upgrade skilleton to 0.3.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-5g3j-89fr-r2vp being exploited?
There is no known exploitation of GHSA-5g3j-89fr-r2vp in the wild and no public exploit code.