Skill Vision Control
Monthly
Path traversal in Jane-xiaoer skill-vision-control 1.3.0 and earlier allows locally authenticated low-privileged users to escape the intended skill versions directory by supplying crafted `skillName` input to the `getSkillVersionsDir` function in `src/svc/utils/config.ts`, enabling unauthorized read and write access to arbitrary local files within the application process's reach. A proof-of-concept exploit exists (CVSS 4.0 supplemental metric E:P), modestly elevating urgency despite the otherwise constrained attack surface. No patch has been released - the vendor has not responded to the disclosure filed via GitHub issue tracker.
Path traversal in Jane-xiaoer skill-vision-control 1.3.0 and earlier allows locally authenticated low-privileged users to escape the intended skill versions directory by supplying crafted `skillName` input to the `getSkillVersionsDir` function in `src/svc/utils/config.ts`, enabling unauthorized read and write access to arbitrary local files within the application process's reach. A proof-of-concept exploit exists (CVSS 4.0 supplemental metric E:P), modestly elevating urgency despite the otherwise constrained attack surface. No patch has been released - the vendor has not responded to the disclosure filed via GitHub issue tracker.