GHSA-PPFX-73J5-FHXC

Vulnerability from github – Published: 2026-02-17 18:55 – Updated: 2026-02-19 21:56
VLAI?
Summary
Skill-scanner Unsecured Network Binding Vulnerability
Details

Description: A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of service (DoS) condition or upload arbitrary files.

This vulnerability is due to an erroneous binding to multiple interfaces. An attacker could exploit this vulnerability by sending API requests to a device exposing the affected API Server. A successful exploit could allow the attacker to consume an excessive amount of resources (memory starvation) or to upload files to arbitrary folders on the affected device.

Conditions: This vulnerability affects Skill-scanner 1.0.1 and earlier releases when the API Server is enabled. The API Server is not enabled by default.

Fixed Software: Skill-scanner software releases 1.0.2 and later contained the fix for this vulnerability.

For more information: If you have any questions or comments about this advisory: - Open an issue in cisco-ai-defense/skill-scanner - Email Cisco Open Source Security (oss-security@cisco.com) and Cisco PSIRT (psirt@cisco.com)

Credits:

  • Research: Richard Tweed (@RichardoC)
  • Fix ideation and implementation: Richard Tweed (@RichardoC)
  • Release engineering: Vineeth Sai Narajala (@vineethsai7)
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cisco-ai-skill-scanner"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26057"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T18:55:39Z",
    "nvd_published_at": "2026-02-19T19:22:29Z",
    "severity": "MODERATE"
  },
  "details": "**Description:**\nA vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of service (DoS) condition or upload arbitrary files.\n\nThis vulnerability is due to an erroneous binding to multiple interfaces. An attacker could exploit this vulnerability by sending API requests to a device exposing the affected API Server. A successful exploit could allow the attacker to consume an excessive amount of resources (memory starvation) or to upload files to arbitrary folders on the affected device.\n\n**Conditions:**\nThis vulnerability affects Skill-scanner 1.0.1 and earlier releases when the API Server is enabled. The API Server is not enabled by default.\n\n**Fixed Software:**\nSkill-scanner software releases 1.0.2 and later contained the fix for this vulnerability.\n\n**For more information:**\nIf you have any questions or comments about this advisory:\n- [Open an issue in cisco-ai-defense/skill-scanner](https://github.com/cisco-ai-defense/skill-scanner/issues)\n- Email Cisco Open Source Security ([oss-security@cisco.com](mailto:oss-security@cisco.com)) and Cisco PSIRT ([psirt@cisco.com](mailto:psirt@cisco.com))\n\n**Credits:**\n\n- Research: Richard Tweed (@RichardoC)\n- Fix ideation and implementation: Richard Tweed (@RichardoC)\n- Release engineering: Vineeth Sai Narajala (@vineethsai7)",
  "id": "GHSA-ppfx-73j5-fhxc",
  "modified": "2026-02-19T21:56:06Z",
  "published": "2026-02-17T18:55:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cisco-ai-defense/skill-scanner/security/advisories/GHSA-ppfx-73j5-fhxc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26057"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cisco-ai-defense/skill-scanner/commit/1e35e57f3051ecc89ba845ae7206321c8eac20a1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cisco-ai-defense/skill-scanner"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skill-scanner Unsecured Network Binding Vulnerability"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.