GHSA-5g3j-89fr-r2vp

Summary

skilleton versions prior to 0.3.1 include security-related weaknesses in repository normalization and path handling logic.
Version 0.3.1 contains fixes and additional test coverage for these issues.

Affected Versions

<0.3.1

Patched Versions

>=0.3.1

Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.
0.3.1 mitigates this by:

• replacing vulnerable parsing behavior with deterministic logic,
• validating subpaths earlier before allocating git worktree resources,
• adding stricter and broader regression tests around these flows.

Severity

Low to Moderate (project-maintainer assessed)

Mitigation

Upgrade to 0.3.1 or later.

Workarounds

No complete workaround is recommended other than upgrading.

References

• Branch: fix/security-code-scanning-alerts
• Commits:
  • fix(security): harden git arg handling and path validation
  • fix(security): use while loop in normalizeRepoUrl instead of regex
• Security Policy: SECURITY.md

Credits

Detected through automated code scanning and remediated by project maintainers.