{"action":"Upgrade skillctl to 0.1.3 or later.","affected":[{"fixed":"0.1.3","introduced":"0"}],"component":"skillctl","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.1.3"],"ghsa_id":"GHSA-74p7-6h78-gw8p","id":"tcs_01M5KETZ8JSH9NH6DCK33SE558","modified_at":"2026-06-22T23:00:12.570873828Z","published_at":"2026-06-22T22:45:16Z","references":["https://osv.dev/vulnerability/GHSA-74p7-6h78-gw8p","https://github.com/umanio-agency/skillctl/security/advisories/GHSA-74p7-6h78-gw8p","https://github.com/umanio-agency/skillctl/security/advisories/GHSA-wx3m-whqv-xv47","https://github.com/umanio-agency/skillctl/commit/28dfce3","https://github.com/umanio-agency/skillctl","https://github.com/umanio-agency/skillctl/releases/tag/v0.1.3"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-74p7-6h78-gw8p","url":"https://osv.dev/vulnerability/GHSA-74p7-6h78-gw8p"}],"summary":"skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery"}