An unauthenticated code injection vulnerability in the Skim project allows attackers to execute arbitrary code via malicious pull requests, posing a significant risk to repository integrity.

The vulnerability exists in the generate-files job within the GitHub Actions workflow, which insecurely checks out and executes code from attacker-controlled forks. This allows any unauthenticated GitHub user to trigger code execution with access to sensitive environment variables, including the GITHUB_TOKEN.

The exploitation of this vulnerability could lead to unauthorized repository modifications, leakage of sensitive build secrets, and potential supply chain compromise. Given the CVSS score of 7.4, this flaw represents a high risk to the development pipeline, as it enables an attacker to gain write access to the project and potentially pivot into internal infrastructure.

Immediate Action: Update the project configuration to the commit bf63404ad51985b00ed304690ba9d477860a5a75 or higher to resolve the insecure workflow execution.

Proactive Monitoring: Review GitHub Actions execution logs for anomalous jobs triggered by pull requests from untrusted contributors or external forks.

Compensating Controls: Implement strict permissions for GitHub Actions tokens and use environment protection rules to require manual approval for workflows triggered by pull requests from outside the organization.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk to repository security by allowing unauthenticated code execution via the CI/CD pipeline. Administrators must prioritize the application of the provided patch immediately to prevent potential supply chain attacks. Continuous oversight of workflow permissions is essential to prevent similar future incidents.