PT-2026-33557 · Npm · Skilleton

Published 2026-04-08 · Updated 2026-04-08

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic. Version 0.3.1 contains fixes and additional test coverage for these issues.

Affected Versions

<0.3.1

Patched Versions

>=0.3.1

Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths. 0.3.1 mitigates this by:

• replacing vulnerable parsing behavior with deterministic logic,
• validating subpaths earlier before allocating git worktree resources,
• adding stricter and broader regression tests around these flows.

Severity

Low to Moderate (project-maintainer assessed)

Mitigation

Upgrade to 0.3.1 or later.

Workarounds

No complete workaround is recommended other than upgrading.

References

• Branch: fix/security-code-scanning-alerts
• Commits:
• fix(security): harden git arg handling and path validation
• fix(security): use while loop in normalizeRepoUrl instead of regex
• Security Policy: SECURITY.md

Credits

Detected through automated code scanning and remediated by project maintainers.

Fix

Resource Exhaustion

Argument Injection

DoS

OS Command Injection

Weakness Enumeration

CWE-400

CWE-88

CWE-1333

CWE-78

Related Identifiers

GHSA-5G3J-89FR-R2VP

Affected Products

Skilleton

References · 5

• https://osv.dev/vulnerability/GHSA-5g3j-89fr-r2vp · Vendor Advisory
• https://github.com/Fcmam5/skilleton · Note
• https://github.com/Fcmam5/skilleton/security/advisories/GHSA-5g3j-89fr-r2vp · Note
• https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172 · Note
• https://github.com/Fcmam5/skilleton/pull/9/changes/6613160803ec8655efee9a270eeaa767ad22da8b · Note