medium5.3
CVE-2026-19335
A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0.
Impact
A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Product | Affected versions |
|---|---|
| Jane-Xiaoer Skill-Vision-Control | before 1.3.0. |
Versions were read from the advisory text. No structured product data has been published for this record yet.