CVE-2026-19335 is a path traversal vulnerability in the Jane-xiaoer skill-vision-control project affecting versions up to 1.3.0. The vulnerability resides in the getSkillVersionsDir function within src/svc/utils/config.ts, where improper handling of the skillName argument allows local attackers to traverse directories. Exploitation requires local access with low privileges and does not require user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or official fix has been released, and the project has not responded to the initial report.

An attacker with local access and limited privileges can exploit this vulnerability to perform path traversal, potentially accessing or modifying files outside the intended directory. This could lead to limited information disclosure, integrity compromise, or availability impact. However, the attack cannot be performed remotely and requires local environment access, reducing the overall risk.

No official fix or patch is currently available. Since the vulnerability requires local access, restricting local user permissions and monitoring local access may reduce risk. Users should monitor the project for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.