Skip to content
OpenAdvisories

Package · GitHub Actions

pypa/gh-action-pypi-publish

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical —
    GHSA-5xjx-3w67-w9x9

    pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

    ### Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them…

    pypa/gh-action-pypi-publish GitHub Actions
  • None 0.0
    GHSA-vxmw-7h4f-hqxh

    PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps

    ### Summary `gh-action-pypi-publish` makes use of GitHub Actions expression expansions (i.e. `${{ ... }}`) in contexts that are potentially attacker controllable. Depending on the trigger used to invoke `gh-action-pypi-publish`, this may allow an attacker to …

    pypa/gh-action-pypi-publish GitHub Actions