{"answers":{"affected":"1 open source package ship an affected version, including pypa/gh-action-pypi-publish.","exploited":"There is no known exploitation of GHSA-vxmw-7h4f-hqxh in the wild and no public exploit code.","fix":"Upgrade pypa/gh-action-pypi-publish to 1.13.0 or later.","what":"GHSA-vxmw-7h4f-hqxh is a code injection vulnerability in pypa/gh-action-pypi-publish, published on 4 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-vxmw-7h4f-hqxh and fix it if it is affected.\n\nWhat it is: GHSA-vxmw-7h4f-hqxh is a code injection vulnerability in pypa/gh-action-pypi-publish, published on 4 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-vxmw-7h4f-hqxh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pypa/gh-action-pypi-publish (GitHub Actions): affected all versions; fixed in 1.13.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/ (Markdown: https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/index.md)","id":"GHSA-vxmw-7h4f-hqxh","markdown":"https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/index.md","name":"GHSA-vxmw-7h4f-hqxh","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"GitHub Actions","requires_auth":"low_privilege","summary":"Attackers can inject arbitrary code into GitHub Actions workflows via expression expansions in the PyPI publish action.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\n`gh-action-pypi-publish` makes use of GitHub Actions expression expansions (i.e. `${{ ... }}`) in contexts that are potentially attacker controllable. Depending on the trigger used to invoke `gh-action-pypi-publish`, this may allow an attacker to execute arbitrary code within the context of a workflow step that invokes `gh-action-pypi-publish`.\n\n### Details\n\n`gh-action-pypi-publish` contains a composite action step, `set-repo-and-ref`, that makes use of expression expansions:\n\n```yaml\n  - name: Set repo and ref from which to run Docker container action\n    id: set-repo-and-ref\n    run: |\n      # Set repo and ref from which to run Docker container action\n      # to handle cases in which `github.action_` context is not set\n      # https://github.com/actions/runner/issues/2473\n      REF=${{ env.ACTION_REF || env.PR_REF || github.ref_name }}\n      REPO=${{ env.ACTION_REPO || env.PR_REPO || github.repository }}\n      REPO_ID=${{ env.PR_REPO_ID || github.repository_id }}\n      echo \"ref=$REF\" \u003e\u003e\"$GITHUB_OUTPUT\"\n      echo \"repo=$REPO\" \u003e\u003e\"$GITHUB_OUTPUT\"\n      echo \"repo-id=$REPO_ID\" \u003e\u003e\"$GITHUB_OUTPUT\"\n    shell: bash\n    env:\n      ACTION_REF: ${{ github.action_ref }}\n      ACTION_REPO: ${{ github.action_repository }}\n      PR_REF: ${{ github.event.pull_request.head.ref }}\n      PR_REPO: ${{ github.event.pull_request.head.repo.full_name }}\n      PR_REPO_ID: ${{ github.event.pull_request.base.repo.id }}\n```\n\nPermalink: https://github.com/pypa/gh-action-pypi-publish/blob/db8f07d3871a0a180efa06b95d467625c19d5d5f/action.yml#L114-L125\n\nIn normal intended operation, these expansions are used to establish a correct priority for outputs like `ref` and `repo-id`. \n\nHowever, these expansions have a side effect: because they're done with `${{ ... }}` and not with `${...}` (i.e. normal shell interpolation), they can *bypass normal shell quoting rules*. In particular, if both `env.ACTION_REF` and `env.PR_REF` evaluate to empty strings, then the expression falls back to `github.ref_name`, which can be an attacker controlled string via a branch or tag name. \n\nFor example, if the attacker is able to set a branch name to something like `innocent;cat${IFS}/etc/passwd`, then the `REF` line may expand as:\n\n```bash\nREF=innocent;cat${IFS}/etc/passwd\n```\n\nwhich would set `REF` to `innocent` and then run the attacker's code.\n\nAdditional information about dangerous expansions can be found in [zizmor's `template-injection` rule documentation](https://woodruffw.github.io/zizmor/audits/#template-injection).\n\n### Impact\n\nThe impact of this vulnerability is very low: the expression in question is unlikely to be evaluated in normal operation, since `env.ACTION_REF` should always take precedence.\n\nIn particular, the action is **not** vulnerable in many popular configurations, i.e. those where `pull_request` or `release` or a `push: tags` event is used to call the action.","ecosystems":["GitHub Actions"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps","id":"GHSA-vxmw-7h4f-hqxh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"GitHub Actions","product":null,"products":[],"type":"code_injection","year":"2025"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"GitHub Actions","fixed":["1.13.0"],"introduced":["0"],"last_affected":[],"package":"pypa/gh-action-pypi-publish","purl":null,"source":"GHSA-vxmw-7h4f-hqxh"}],"products":null,"published":"2025-09-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can inject arbitrary code into GitHub Actions workflows via expression expansions in the PyPI publish action.","url":"https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/"}