EUVD-2025-18904Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This issue has been patched in commit 8eb3567.
AnalysisAI
pgai, a Python library for PostgreSQL-based RAG and agentic applications, contains a secrets exfiltration vulnerability (CVE-2025-52467) that allows unauthenticated remote attackers to extract all workflow secrets, including GITHUB_TOKEN credentials with repository write permissions. This vulnerability has a CVSS score of 9.1 (Critical) and affects pgai versions prior to commit 8eb3567; a patch is available and the vulnerability is not currently listed in CISA KEV, though the high CVSS and direct credential exposure indicate substantial real-world risk if the library is deployed in CI/CD environments.
Technical ContextAI
pgai is a Python library that integrates PostgreSQL with generative AI models for retrieval-augmented generation (RAG) and agentic workflow applications. The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper handling or exposure of secrets during workflow execution or logging. The root cause likely involves insufficient isolation of environment variables, secrets, or credentials within the pgai execution context—possibly in workflow orchestration, task execution, or logging mechanisms. This affects pgai versions distributed via Python package management (CPE would be purl:pkg/pypi/pgai or equivalent) prior to the patched commit 8eb3567. The attack surface is particularly concerning because GITHUB_TOKEN exposure with write permissions enables repository tampering, code injection, and supply chain compromise.
RemediationAI
Upgrade pgai to commit 8eb3567 or later. Check the pgai GitHub repository (https://github.com/timescale/pgai) for release tags or version numbers corresponding to or after this commit.; priority: CRITICAL - Apply immediately Immediate Mitigation: Rotate all GITHUB_TOKEN and other secrets that may have been exposed in workflows using pgai. Audit repository for unauthorized commits, releases, or changes made via exposed tokens.; priority: CRITICAL - Before applying patch Monitoring: Review GitHub audit logs for suspicious activity (unauthorized commits, pushes, release creations) during the period pgai was in use with unpatched versions. Check workflow logs for evidence of secrets being logged or exfiltrated.; priority: HIGH Preventive: Implement principle of least privilege for CI/CD tokens: use short-lived tokens, repository-scoped tokens (if available), and dedicated service accounts with minimal permissions for pgai workflows.; priority: HIGH Detection: Deploy secret scanning tools in CI/CD pipelines to prevent accidental credential commits in future versions.; priority: MEDIUM
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today