Skip to content
Fencer Intel
medium —

GHSA-5g3j-89fr-r2vp json

skilleton has improper input handling in repository/path processing

published 7mo ago modified 7mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

## Summary

`skilleton` versions prior to `0.3.1` include security-related weaknesses in repository normalization and path handling logic. Version `0.3.1` contains fixes and additional test coverage for these issues.

## Affected Versions

`<0.3.1`

## Patched Versions

`>=0.3.1`

## Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths. `0.3.1` mitigates this by: - replacing vulnerable parsing behavior with deterministic logic, - validating subpaths earlier before allocating git worktree resources, - adding stricter and broader regression tests around these flows.

## Severity

Low to Moderate (project-maintainer assessed)

## Mitigation

Upgrade to `0.3.1` or later.

## Workarounds

No complete workaround is recommended other than upgrading.

## References

- Branch: [`fix/security-code-scanning-alerts`](https://github.com/Fcmam5/skilleton/pull/9) - Commits: - [fix(security): harden git arg handling and path validation](https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172) - [fix(security): use while loop in normalizeRepoUrl instead of regex](https://github.com/Fcmam5/skilleton/pull/9/changes/6613160803ec8655efee9a270eeaa767ad22da8b) - Security Policy: [SECURITY.md](https://github.com/Fcmam5/skilleton/blob/master/SECURITY.md)

## Credits

Detected through automated code scanning and remediated by project maintainers.

Patch / fix

  • npm skilleton 0.3.1

Is GHSA-5g3j-89fr-r2vp in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm skilleton
<0.3.1
0.3.1

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.