Skip to content
OpenAdvisories

Vendor

spotipy-dev

4 known vulnerabilities.

Products

spotipy 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2025-47928 Public exploit

    Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

    Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by a…

    spotipy-dev spotipy spotipy Ubuntu