{"action":"Upgrade skillctl to 0.1.2 or later.","affected":[{"fixed":"0.1.2","introduced":"0"}],"component":"skillctl","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.1.2"],"ghsa_id":"GHSA-wx3m-whqv-xv47","id":"tcs_01M5KF4BK0BE4HKTKNDGBP9SBF","modified_at":"2026-06-19T05:15:08.472072586Z","published_at":"2026-06-05T19:43:51Z","references":["https://osv.dev/vulnerability/GHSA-wx3m-whqv-xv47","https://github.com/umanio-agency/skillctl/security/advisories/GHSA-wx3m-whqv-xv47","https://github.com/umanio-agency/skillctl/commit/827fff5c0698dd9e48e777d5907cf7bc19b91aca","https://github.com/umanio-agency/skillctl","https://github.com/umanio-agency/skillctl/releases/tag/v0.1.2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-wx3m-whqv-xv47","url":"https://osv.dev/vulnerability/GHSA-wx3m-whqv-xv47"}],"summary":"skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion"}