CVE-2026-19335 in skill-vision-control
Summary
by MITRE • 08/09/2026
A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability identified in Jane-xiaoer skill-vision-control version 1.3.0 represents a critical path traversal flaw within the getSkillVersionsDir function located in src/svc/utils/config.ts. This security weakness stems from insufficient input validation and sanitization of the skillName parameter, which allows malicious actors to manipulate directory paths through crafted input values. The vulnerability specifically affects the application's configuration handling mechanism where user-supplied data directly influences file system operations without proper boundary checks or canonicalization processes.
The technical implementation of this flaw enables attackers to traverse directory structures beyond the intended scope by manipulating the skillName argument. When the application processes this parameter, it fails to properly validate or sanitize the input before using it in file system operations, creating opportunities for directory traversal attacks. This type of vulnerability falls under CWE-23 Path Traversal and is particularly dangerous because it allows attackers to access files outside the designated application directories, potentially leading to unauthorized data access, information disclosure, or even privilege escalation depending on the system configuration and file permissions.
The operational impact of this vulnerability is significant despite its local execution requirement. While the attack vector is restricted to local environments, this limitation does not diminish the severity of the issue. Local attackers with access to the system can exploit this weakness to gain unauthorized access to sensitive configuration files, application data, or even system files that should remain protected. The vulnerability represents a privilege escalation risk for local users who may have limited access but can leverage this flaw to expand their access privileges within the application's operational scope. Additionally, attackers could potentially use this weakness as a foothold for more sophisticated attacks if they can later gain remote access through other vectors.
Security practitioners should consider this vulnerability in relation to ATT&CK framework techniques such as T1059 Command and Scripting Interpreter and T1566 Impersonation, where local privilege escalation could lead to broader system compromise. The lack of response from the project maintainers after early issue reporting creates additional risk as the vulnerability remains unpatched and potentially exploitable by malicious actors who discover it through public channels or reverse engineering efforts. Organizations using this software should implement immediate mitigations including input validation, proper file path canonicalization, and access controls to prevent unauthorized directory traversal operations.
Recommended mitigation strategies include implementing strict input validation for all parameters used in file system operations, utilizing secure coding practices such as whitelisting acceptable characters and patterns, and employing proper path normalization techniques. The application should validate that skillName parameters contain only expected characters and do not include path traversal sequences like ../ or ..\. Additionally, the code should implement proper privilege separation and ensure that file system operations are performed with minimal required permissions. Regular security audits and input validation testing should be conducted to identify similar vulnerabilities in other parts of the application codebase. The vulnerability also highlights the importance of maintaining responsive communication channels with security researchers and promptly addressing reported issues to prevent exploitation by malicious actors who may discover and weaponize such weaknesses before official patches are released.