CVE-2026-41414: Skim Fuzzy Finder Vulnerability Exposes GitHub Tokens

The National Vulnerability Database has disclosed CVE-2026-41414, a high-severity vulnerability affecting Skim, a fuzzy finder utility. This flaw, rated 7.4 CVSS, stems from an insecure GitHub Actions workflow (.github/workflows/pr.yml) where the generate-files job executes attacker-controlled code from a pull request with elevated permissions. Specifically, it grants access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (with contents:write scope).

Crucially, there are no gates preventing exploitation. Any GitHub user can trigger this by simply opening a pull request from a fork. This means a malicious actor could leverage a crafted pull request to gain unauthorized access to sensitive repository secrets, potentially leading to repository compromise or further lateral movement within GitHub’s ecosystem. The vulnerability is addressed in commit bf63404ad51985b00ed304690ba9d477860a5a75.

This incident is a stark reminder of the inherent risks in overly permissive CI/CD pipelines, especially those executing untrusted code with elevated privileges. The attacker’s calculus here is low effort, high reward: a simple pull request can unlock critical secrets. Defenders need to scrutinize their GitHub Actions workflows, particularly those triggered by external contributions, to ensure least privilege and robust input validation.