The vulnerability arises from the GitHub Actions workflow in skim-rs that runs code from forked pull requests without sufficient validation or gating. This allows an attacker to execute arbitrary code within the workflow environment, gaining access to sensitive tokens with write permissions. The flaw is classified as CWE-94 (Improper Control of Generation of Code). The vulnerability affects all versions prior to commit bf63404ad51985b00ed304690ba9d477860a5a75, which contains the fix. The CVSS 3.1 score is 7.4 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can execute arbitrary code in the GitHub Actions environment by submitting a pull request from a forked repository. This execution has access to sensitive secrets including SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN with write permissions, potentially allowing unauthorized code changes or repository manipulation. The integrity of the project and its codebase can be compromised. There is no reported impact on confidentiality or availability. No known public exploits have been reported to date.

A fix is available and implemented in commit bf63404ad51985b00ed304690ba9d477860a5a75. Users should update to this commit or later versions to remediate the vulnerability. Until patched, it is recommended to restrict or disable workflows that run untrusted code from forked pull requests or to implement proper gating controls to prevent execution of attacker-controlled code with access to sensitive secrets.