CVE-2026-41414
High
Description
Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). No gates prevent exploitation - any GitHub user can trigger this by opening a pull request from a fork. This vulnerability is fixed with commit bf63404ad51985b00ed304690ba9d477860a5a75.
SeverityHigh
CVSS7.4
Exploit probability—
ProductSkim
PublishedApr 24, 2026
First seenApr 24, 2026
Weakness typeCWE-94Code injection
How to fix
Update
- skim-rs skim4.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| skim-rs skim | v < 4.6.1 | 4.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.