EUVD-2025-18904CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Description
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This issue has been patched in commit 8eb3567.
Analysis
pgai, a Python library for PostgreSQL-based RAG and agentic applications, contains a secrets exfiltration vulnerability (CVE-2025-52467) that allows unauthenticated remote attackers to extract all workflow secrets, including GITHUB_TOKEN credentials with repository write permissions. This vulnerability has a CVSS score of 9.1 (Critical) and affects pgai versions prior to commit 8eb3567; a patch is available and the vulnerability is not currently listed in CISA KEV, though the high CVSS and direct credential exposure indicate substantial real-world risk if the library is deployed in CI/CD environments.
Technical Context
pgai is a Python library that integrates PostgreSQL with generative AI models for retrieval-augmented generation (RAG) and agentic workflow applications. The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper handling or exposure of secrets during workflow execution or logging. The root cause likely involves insufficient isolation of environment variables, secrets, or credentials within the pgai execution context—possibly in workflow orchestration, task execution, or logging mechanisms. This affects pgai versions distributed via Python package management (CPE would be purl:pkg/pypi/pgai or equivalent) prior to the patched commit 8eb3567. The attack surface is particularly concerning because GITHUB_TOKEN exposure with write permissions enables repository tampering, code injection, and supply chain compromise.
Affected Products
pgai (Python library) (Prior to commit 8eb3567); pgai (Python library) (From commit 8eb3567 onwards)
Remediation
Upgrade pgai to commit 8eb3567 or later. Check the pgai GitHub repository (https://github.com/timescale/pgai) for release tags or version numbers corresponding to or after this commit.; priority: CRITICAL - Apply immediately Immediate Mitigation: Rotate all GITHUB_TOKEN and other secrets that may have been exposed in workflows using pgai. Audit repository for unauthorized commits, releases, or changes made via exposed tokens.; priority: CRITICAL - Before applying patch Monitoring: Review GitHub audit logs for suspicious activity (unauthorized commits, pushes, release creations) during the period pgai was in use with unpatched versions. Check workflow logs for evidence of secrets being logged or exfiltrated.; priority: HIGH Preventive: Implement principle of least privilege for CI/CD tokens: use short-lived tokens, repository-scoped tokens (if available), and dedicated service accounts with minimal permissions for pgai workflows.; priority: HIGH Detection: Deploy secret scanning tools in CI/CD pipelines to prevent accidental credential commits in future versions.; priority: MEDIUM
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today