CVE-2026-41414

Published: Apr 24, 2026Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). No gates prevent exploitation - any GitHub user can trigger this by opening a pull request from a fork. This vulnerability is fixed with commit bf63404ad51985b00ed304690ba9d477860a5a75.

Affected (1)

Products: Skim Rs: Skim

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Skim Rs Skim	Before 4.6.1

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://github.com/skim-rs/skim/commit/bf63404ad51985b00ed304690ba9d477860a5a75

Source: security-advisories@github.com

Patch

https://github.com/skim-rs/skim/security/advisories/GHSA-9g93-rxr5-xhqw

Source: security-advisories@github.com

Third Party Advisory

https://drive.google.com/file/d/1Gj7ziTK42YWXYoQgTbis_rMitHR59J6F/view

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

https://github.com/skim-rs/skim/security/advisories/GHSA-9g93-rxr5-xhqw

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party Advisory

Timeline

No history available yet.