{"answers":{"affected":"2 open source packages ship an affected version, including skillctl.","exploited":"There is no known exploitation of GHSA-wx3m-whqv-xv47 in the wild and no public exploit code.","fix":"Upgrade skillctl to 0.1.2 or later.","what":"GHSA-wx3m-whqv-xv47 is a path traversal vulnerability in skillctl, published on 5 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-wx3m-whqv-xv47 and fix it if it is affected.\n\nWhat it is: GHSA-wx3m-whqv-xv47 is a path traversal vulnerability in skillctl, published on 5 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-wx3m-whqv-xv47 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- skillctl (crates.io): affected all versions; fixed in 0.1.2\n- skillctl (crates.io): affected all versions; fixed in 0.1.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/ (Markdown: https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/index.md)","id":"GHSA-wx3m-whqv-xv47","markdown":"https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/index.md","name":"GHSA-wx3m-whqv-xv47","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Rust CLI tool","requires_auth":"none","summary":"Attackers can exfiltrate secrets or delete files via malicious skills libraries or config files in skillctl, requiring user interaction to pull or push.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Impact\n\n`skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attacker to:\n\n1. **Exfiltrate arbitrary files on the operator's machine** by publishing a malicious skills library containing a symlink inside a skill folder (e.g. `niania → /home/user/.aws/credentials`). The symlink fell through `entry.file_type().is_dir()` in `fs_util::copy_dir_all`, was dereferenced by `fs::copy`, and the target's content was copied into the project. A subsequent `skillctl push` would have published the secret to the (possibly public) library — what the reporter called \"round-trip path exfiltration\".\n\n2. **Delete arbitrary directories outside the project or library root** by crafting a `.skills.toml` with a malicious `destination` or `source_path` field. Both were deserialized as `PathBuf` with zero validation. Because `Path::join` lets an absolute right-hand side replace the base, `destination = \"/home/user/.ssh\"` made `cwd.join(...)` resolve outside the project; `..` traversal was equally unguarded. Downstream `remove_dir_all` in `replace_folder_contents` then wiped arbitrary writable directories on `skillctl pull` / `push` / `detect`. `.skills.toml` is the exact kind of file teams commit and exchange via PR; a single merged malicious PR was sufficient to weaponise the maintainer's next `skillctl pull --all`.\n\n3. **`detect --target` accepted `..` traversal**, even though absolute paths were rejected. `--target ../../../etc` would have written outside the library root.\n\n4. **Fork-name validation accepted `.` and `..` literally**, so a fork named `..` would have produced a `Path::join` resolving to the parent directory and `fs::rename` could have clobbered it.\n\n## Patches\n\nFixed in [v0.1.2](https://github.com/umanio-agency/skillctl/releases/tag/v0.1.2):\n\n- Symlinks inside skill folders are hard-rejected at copy time (both top-level source and any descendant entry).\n- `.skills.toml` `destination` and `source_path` are validated at load time and reject absolute paths, `..` components, and Windows-prefix components.\n- A new `path_safety::safe_join` helper is wired (defense-in-depth) at every destructive call site in `pull.rs` / `push.rs`.\n- `detect --target` and the interactive custom-path prompt go through the same `validate_relative_subpath` helper.\n- `validate_fork_name` explicitly rejects `.` and `..`.\n\nThreat-model note: the fix is purely lexical (component-level) plus an explicit symlink check at copy time. No filesystem `canonicalize` calls were added, avoiding TOCTOU windows.\n\n## Credit\n\nReported privately on 2026-05-19 by **firebaguette** via the Umanio Discord (the reporter declined GitHub credit, so this advisory carries no structured credits field).","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion","id":"GHSA-wx3m-whqv-xv47","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.1.2"],"introduced":["0"],"last_affected":[],"package":"skillctl","purl":null,"source":"GHSA-wx3m-whqv-xv47"},{"ecosystem":"crates.io","fixed":["0.1.2"],"introduced":["0"],"last_affected":[],"package":"skillctl","purl":"pkg:cargo/skillctl","source":"GHSA-wx3m-whqv-xv47"}],"products":null,"published":"2026-06-05","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can exfiltrate secrets or delete files via malicious skills libraries or config files in skillctl, requiring user interaction to pull or push.","url":"https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/"}