Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). No gates prevent exploitation - any GitHub user can trigger this by opening a pull request from a fork. This vulnerability is fixed with commit bf63404ad51985b00ed304690ba9d477860a5a75.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | General1 |
| 2026-04-25 | 1 | Disclosure1 |
CVE-2026-41414 Arbitrary Code Execution in Skim via Unprotected GitHub Actions Workflow https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41414
Post summary
This is a disclosure of CVE-2026-41414, indicating arbitrary code execution via an unprotected GitHub Actions workflow in Skim, with no evidence of a PoC, exploit, or patch.
CVE-2026-41414 Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and… https://www.cve.org/CVERecord?id=CVE-2026-41414
Post summary
The statement notes CVE-2026-41414 with limited context and no actionable details such as PoC, exploit, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | skim-rs | skim | - | rust | - |