crates.io/skilo: medium 6.5
skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source
Action: Upgrade skilo to 0.11.1 or later.
cargo update -p skilo --precise 0.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.5.0 | 0.11.1 | - |
Fixed versions
| 0.11.1 |
Sources
- osv: GHSA-6xx4-9wp6-65p7
- https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7
- https://github.com/manuelmauro/skilo/pull/11
- https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e
- https://github.com/manuelmauro/skilo
- https://github.com/manuelmauro/skilo/releases/tag/v0.11.1
published · modified · JSON