Threats tagged 'ghsa-j882-vpg7-hqjh'

A path traversal vulnerability exists in Jane-xiaoer skill-vision-control up to version 1.3.0 in the getSkillVersionsDir function of src/svc/utils/config.ts. The vulnerability allows local attackers with limited privileges to manipulate the skillName argument to perform path traversal. The issue was reported early but has not yet been addressed by the project. The CVSS score is 5.3, indicating a low severity level.