Executive brief
skilleton is a Node.js utility for managing Git repository operations. The application contains security weaknesses in how it validates and processes repository URLs and file paths, which could allow attackers to craft malicious input that triggers unsafe behavior or resource consumption. The vulnerabilities affect command argument handling and path traversal validation, potentially enabling command injection or inefficient processing that could degrade service availability.
Technical details
skilleton contains improper input handling affecting repository URL normalization and path processing, with weaknesses spanning OS command injection (CWE-78), argument injection (CWE-88), uncontrolled resource consumption (CWE-400), and inefficient regular expressions (CWE-1333). The root cause involves insufficient validation and sanitization of user-supplied repository URLs and subpaths before use in Git command construction and file system operations. The vulnerability is triggered via crafted input to the repository URL and path handling functions; no authentication is required. An attacker can supply malicious input to cause unsafe command execution or resource exhaustion. Version 0.3.1 fixes this by replacing regex-based parsing with deterministic logic, hardening git argument handling, and validating subpaths before allocating Git worktree resources.
Affected products
- skilleton skilleton <0.3.1
Timeline
- 2026-04-08: disclosed: Advisory GHSA-5g3j-89fr-r2vp published
- 2026-04-05: patched: Version 0.3.1 released with security fixes