How severe is GHSA-5g3j-89fr-r2vp?

No CVSS score has been assigned to GHSA-5g3j-89fr-r2vp yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5g3j-89fr-r2vp?

GHSA-5g3j-89fr-r2vp affects the following packages: skilleton (npm). Ecosystems affected: npm.

How do I fix GHSA-5g3j-89fr-r2vp?

Update skilleton to 0.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5g3j-89fr-r2vp is resolved across your whole dependency graph.

How do I detect GHSA-5g3j-89fr-r2vp in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for skilleton, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5g3j-89fr-r2vp if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-5g3j-89fr-r2vp actively exploited in the wild?

No public exploit code has been indexed for GHSA-5g3j-89fr-r2vp yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5g3j-89fr-r2vp published, and has it been updated?

GHSA-5g3j-89fr-r2vp was published on April 8, 2026 and was last updated on April 8, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

skilleton has improper input handling in repository/path processingGHSA-5g3j-89fr-r2vp

Fix: Fcmam5/skilleton#9

GHSA-5g3j-89fr-r2vp is a security vulnerability in skilleton. A fix is available for skilleton — see the affected versions and patch details below.

Published

Apr 8, 2026

Updated

Apr 8, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Apr 8, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

skilletonnpm

34downloads / week

Description

Summary

skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic.
Version 0.3.1 contains fixes and additional test coverage for these issues.

Affected Versions

<0.3.1

Patched Versions

>=0.3.1

Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.
0.3.1 mitigates this by:

replacing vulnerable parsing behavior with deterministic logic,
validating subpaths earlier before allocating git worktree resources,
adding stricter and broader regression tests around these flows.

Severity

Low to Moderate (project-maintainer assessed)

Mitigation

Upgrade to 0.3.1 or later.

Workarounds

No complete workaround is recommended other than upgrading.

References

Branch: fix/security-code-scanning-alerts
Commits:
- fix(security): harden git arg handling and path validation
- fix(security): use while loop in normalizeRepoUrl instead of regex
Security Policy: SECURITY.md

Credits

Detected through automated code scanning and remediated by project maintainers.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`skilleton`	all versions	0.3.1`npm install skilleton@0.3.1`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for skilleton, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update skilleton to 0.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5g3j-89fr-r2vp is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

## Summary `skilleton` versions prior to `0.3.1` include security-related weaknesses in repository normalization and path handling logic. Version `0.3.1` contains fixes and additional test coverage for these issues. ## Affected Versions `<0.3.1` ## Patched Versions `>=0.3.1` ## Impact In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths. `0.3.1` mitigates this by: - replacing vulnerable parsing behavior with deterministic logic, - validating subpaths earlier before allocating git worktree resources, - adding strict

O3 Security · Impact-Aware SCA

Is GHSA-5g3j-89fr-r2vp in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works