What is GHSA-5G3J-89FR-R2VP?

GHSA-5G3J-89FR-R2VP is a medium-severity OS command injection vulnerability in skilleton (npm), affecting versions < 0.3.1. It is fixed in 0.3.1. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.

Which versions of skilleton are affected by GHSA-5G3J-89FR-R2VP?

skilleton (npm) versions < 0.3.1 is affected.

Is there a fix for GHSA-5G3J-89FR-R2VP?

Yes. GHSA-5G3J-89FR-R2VP is fixed in 0.3.1. Upgrade to this version or later.

Is GHSA-5G3J-89FR-R2VP exploitable, and should I be worried?

Whether GHSA-5G3J-89FR-R2VP is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-5G3J-89FR-R2VP is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-5G3J-89FR-R2VP in skilleton

Q: Which versions of skilleton are affected by GHSA-5G3J-89FR-R2VP?

skilleton (npm) versions < 0.3.1 is affected.

Q: Is there a fix for GHSA-5G3J-89FR-R2VP?

Yes. GHSA-5G3J-89FR-R2VP is fixed in 0.3.1. Upgrade to this version or later.

Q: Is GHSA-5G3J-89FR-R2VP exploitable, and should I be worried?

Whether GHSA-5G3J-89FR-R2VP is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-5G3J-89FR-R2VP is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-5G3J-89FR-R2VP?

Upgrade skilleton to 0.3.1 or later.

Summary

skilleton has improper input handling in repository/path processing

skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic.
Version 0.3.1 contains fixes and additional test coverage for these issues.

Affected Versions

<0.3.1

Patched Versions

>=0.3.1

Severity

Low to Moderate (project-maintainer assessed)

Mitigation

Upgrade to 0.3.1 or later.

Workarounds

No complete workaround is recommended other than upgrading.

References

Branch: fix/security-code-scanning-alerts
Commits:
- fix(security): harden git arg handling and path validation
- fix(security): use while loop in normalizeRepoUrl instead of regex
Security Policy: SECURITY.md

Credits

Detected through automated code scanning and remediated by project maintainers.

Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.
0.3.1 mitigates this by:

replacing vulnerable parsing behavior with deterministic logic,
validating subpaths earlier before allocating git worktree resources,
adding stricter and broader regression tests around these flows.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

Affected versions

skilleton (< 0.3.1)

Security releases

skilleton → 0.3.1 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade skilleton to 0.3.1 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-5G3J-89FR-R2VP? GHSA-5G3J-89FR-R2VP is a medium-severity OS command injection vulnerability in skilleton (npm), affecting versions < 0.3.1. It is fixed in 0.3.1. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
Which versions of skilleton are affected by GHSA-5G3J-89FR-R2VP? skilleton (npm) versions < 0.3.1 is affected.
Is there a fix for GHSA-5G3J-89FR-R2VP? Yes. GHSA-5G3J-89FR-R2VP is fixed in 0.3.1. Upgrade to this version or later.
Is GHSA-5G3J-89FR-R2VP exploitable, and should I be worried? Whether GHSA-5G3J-89FR-R2VP is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-5G3J-89FR-R2VP is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-5G3J-89FR-R2VP? Upgrade skilleton to 0.3.1 or later.