CVE-2026-41414: 
NixOS vulnerability analysis and mitigation

CVE-2026-41414 is an arbitrary code execution vulnerability in the Skim fuzzy finder project (skim-rs/skim) caused by an insecure GitHub Actions workflow configuration. The generate-files job in .github/workflows/pr.yml uses the pull_request_target trigger while checking out and executing attacker-controlled fork code via cargo run, with access to the SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (with contents:write permissions). Any GitHub user can trigger this by opening a pull request from a fork — no approval gates or conditions are required. It affects all versions of skim prior to 4.6.1 and carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerable pattern combines three dangerous elements: the pull_request_target workflow trigger (which runs with base repository secrets), a checkout step using head.ref and head.repo.full_name (which fetches the attacker's fork code rather than the base branch), and a cargo run invocation that compiles and executes that attacker-controlled Rust code. The app installation token created via create-github-app-token is stored in git credentials on the runner at /home/runner/work/_temp/git-credentials-*, making it accessible to any code running in the workflow. There are no if: conditions, label gates, or approval requirements on the job, meaning exploitation requires only the ability to open a pull request (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary Rust code within the GitHub Actions runner environment with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). The exfiltrated app installation token can be used to push malicious code to non-protected branches, create tags, and trigger downstream workflows such as release.yml and publish.yml, potentially resulting in a poisoned crate being published to crates.io — affecting the approximately 124 crates that depend on skim. If the GitHub App is installed on other skim-rs repositories, the private key grants write access to those repositories as well, amplifying the supply chain impact (GitHub Advisory).

No confirmed in-the-wild exploitation has been reported, and no functional public exploit code is available — a referenced proof-of-concept video (Google Drive) is inaccessible without authentication (Feedly). The vulnerability is trivially exploitable by any GitHub user with the ability to fork the repository and open a pull request, requiring no special privileges. The EPSS score is approximately 0.03%, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The researcher avivdon is credited with discovery and reported the issue via GitHub's security advisory process (GitHub Advisory).

1. Fork the repository: Create a fork of skim-rs/skim on GitHub under an attacker-controlled account.
2. Inject malicious code: Modify src/bin/main.rs or add a build.rs file in the fork to include code that reads the git credential file at /home/runner/work/_temp/git-credentials-* and exfiltrates its contents (including the app installation token) to an attacker-controlled server via an HTTP request.
3. Open a pull request: Submit a pull request from the malicious fork to the upstream skim-rs/skim repository. This immediately triggers the pull_request_target workflow in .github/workflows/pr.yml with no approval gate.
4. Workflow executes attacker code: The generate-files job checks out the fork's code using head.ref and head.repo.full_name, then runs cargo run, compiling and executing the attacker's Rust code with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN.
5. Exfiltrate credentials: The malicious code reads the git credential file and sends the app installation token to the attacker's server.
6. Abuse token for supply chain attack: Use the exfiltrated token to push malicious commits to non-protected branches, create a new version tag (e.g., v4.5.2), trigger release.yml to build poisoned binaries, and invoke publish.yml to publish a compromised crate to crates.io using CRATES_IO_TOKEN (GitHub Advisory).

• GitHub Actions Logs: Unexpected cargo run executions in the generate-files job triggered by pull requests from external forks; workflow runs initiated by unknown or external GitHub accounts.
• Network: Outbound HTTP/HTTPS connections from the GitHub Actions runner to unknown external IP addresses or domains during the cargo run step; DNS queries to attacker-controlled domains from the runner environment.
• File System (Runner): Access or reads to /home/runner/work/_temp/git-credentials-* by the compiled Rust binary; unexpected binary artifacts or scripts created during the build step.
• Repository Activity: Unexpected commits or tags pushed to non-protected branches by the GitHub App bot account; new releases or crate publishes not initiated by maintainers; modifications to Cargo.toml version fields without corresponding maintainer activity.
• Crates.io: New crate versions published outside of the normal release cycle or without corresponding signed commits from known maintainers (GitHub Advisory).

The fix was implemented in commit bf63404ad51985b00ed304690ba9d477860a5a75, which deletes the dangerous pr.yml workflow entirely and replaces its functionality with a local just recipe (pr-review) that runs only in a trusted, maintainer-controlled environment (GitHub Commit). Users and maintainers of the skim project should update to version 4.6.1 or later. Additionally, maintainers should rotate SKIM_RS_BOT_PRIVATE_KEY and audit GITHUB_TOKEN activity for the affected period. For other projects using similar patterns, GitHub recommends never combining pull_request_target with fork checkouts and code execution — instead, use pull_request (which lacks secret access) or implement mandatory approval gates before any job that accesses secrets (GitHub Advisory).

The vulnerability was discovered and reported by security researcher avivdon and published as a GitHub Security Advisory by maintainer LoricAndre on April 15, 2026 (GitHub Advisory). The advisory explicitly references GitHub's security hardening guide and known blog posts on pull_request_target risks, highlighting that this is a well-documented dangerous pattern in the CI/CD security community. Coverage appeared on security aggregators and vulnerability databases shortly after disclosure, and openSUSE issued a security announcement for downstream package updates (openSUSE).