Python CVE-2025-52467

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N vector indicates Network-accessible, Low complexity, No privilege required exploitation resulting in High Confidentiality and Integrity impact—a near-worst-case profile. The attack requires no user interaction and can be automated. Although KEV status is not actively listed (suggesting no in-the-wild exploitation at public disclosure), the vulnerability's nature (direct secrets exfiltration in a CI/CD context) makes it extremely high-priority for organizations using pgai in GitHub Actions or similar workflows. EPSS score is likely elevated (>0.90) given the exploitability profile. The combination of unauthenticated access, no complexity barriers, and direct access to repository credentials makes this a critical supply chain risk, particularly for projects with automated deployments or release pipelines. Real-world risk is SEVERE for any pgai deployment handling sensitive repositories.

An attacker discovers that a target organization uses pgai in GitHub Actions for data processing and model inference. The attacker triggers a pgai workflow (via a pull request or direct workflow dispatch, if exposed) or waits for an automated scheduled workflow. Because pgai versions prior to 8eb3567 exfiltrate secrets (including GITHUB_TOKEN), the attacker extracts the token with repository write permissions. The attacker then uses this token to: (1) commit and push malicious code to the main branch, (2) create unauthorized releases, (3) modify CI/CD configurations to inject additional payload, or (4) exfiltrate proprietary code or data. This attack requires no authentication, no user interaction, and can be fully automated. If the exposed token has organization-level access, the attacker can compromise multiple repositories. The attack is particularly dangerous in supply chain contexts where pgai-using projects publish libraries or services to package registries or production environments.