# GHSA-vxmw-7h4f-hqxh: PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps

> Attackers can inject arbitrary code into GitHub Actions workflows via expression expansions in the PyPI publish action.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Sep 2025

## What is GHSA-vxmw-7h4f-hqxh?

GHSA-vxmw-7h4f-hqxh is a code injection vulnerability in pypa/gh-action-pypi-publish, published on 4 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

### Summary

`gh-action-pypi-publish` makes use of GitHub Actions expression expansions (i.e. `${{ ... }}`) in contexts that are potentially attacker controllable. Depending on the trigger used to invoke `gh-action-pypi-publish`, this may allow an attacker to execute arbitrary code within the context of a workflow step that invokes `gh-action-pypi-publish`.

### Details

`gh-action-pypi-publish` contains a composite action step, `set-repo-and-ref`, that makes use of expression expansions:

```yaml
  - name: Set repo and ref from which to run Docker container action
    id: set-repo-and-ref
    run: |
      # Set repo and ref from which to run Docker container action
      # to handle cases in which `github.action_` context is not set
      # https://github.com/actions/runner/issues/2473
      REF=${{ env.ACTION_REF || env.PR_REF || github.ref_name }}
      REPO=${{ env.ACTION_REPO || env.PR_REPO || github.repository }}
      REPO_ID=${{ env.PR_REPO_ID || github.repository_id }}
      echo "ref=$REF" >>"$GITHUB_OUTPUT"
      echo "repo=$REPO" >>"$GITHUB_OUTPUT"
      echo "repo-id=$REPO_ID" >>"$GITHUB_OUTPUT"
    shell: bash
    env:
      ACTION_REF: ${{ github.action_ref }}
      ACTION_REPO: ${{ github.action_repository }}
      PR_REF: ${{ github.event.pull_request.head.ref }}
      PR_REPO: ${{ github.event.pull_request.head.repo.full_name }}
      PR_REPO_ID: ${{ github.event.pull_request.base.repo.id }}
```

Permalink: https://github.com/pypa/gh-action-pypi-publish/blob/db8f07d3871a0a180efa06b95d467625c19d5d5f/action.yml#L114-L125

In normal intended operation, these expansions are used to establish a correct priority for outputs like `ref` and `repo-id`. 

However, these expansions have a side effect: because they're done with `${{ ... }}` and not with `${...}` (i.e. normal shell interpolation), they can *bypass normal shell quoting rules*. In particular, if both `env.ACTION_REF` and `env.PR_REF` evaluate to empty strings, then the expression falls back to `github.ref_name`, which can be an attacker controlled string via a branch or tag name. 

For example, if the attacker is able to set a branch name to something like `innocent;cat${IFS}/etc/passwd`, then the `REF` line may expand as:

```bash
REF=innocent;cat${IFS}/etc/passwd
```

which would set `REF` to `innocent` and then run the attacker's code.

Additional information about dangerous expansions can be found in [zizmor's `template-injection` rule documentation](https://woodruffw.github.io/zizmor/audits/#template-injection).

### Impact

The impact of this vulnerability is very low: the expression in question is unlikely to be evaluated in normal operation, since `env.ACTION_REF` should always take precedence.

In particular, the action is **not** vulnerable in many popular configurations, i.e. those where `pull_request` or `release` or a `push: tags` event is used to call the action.

## Which versions are affected by GHSA-vxmw-7h4f-hqxh?

1 open source package ship an affected version, including pypa/gh-action-pypi-publish.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `pypa/gh-action-pypi-publish` | GitHub Actions | All versions | 1.13.0 |

## How do I fix GHSA-vxmw-7h4f-hqxh?

Upgrade pypa/gh-action-pypi-publish to 1.13.0 or later.

## Is GHSA-vxmw-7h4f-hqxh being exploited?

There is no known exploitation of GHSA-vxmw-7h4f-hqxh in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-vxmw-7h4f-hqxh and fix it if it is affected.

What it is: GHSA-vxmw-7h4f-hqxh is a code injection vulnerability in pypa/gh-action-pypi-publish, published on 4 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-vxmw-7h4f-hqxh in the wild and no public exploit code.

Affected packages and fixed versions:
- pypa/gh-action-pypi-publish (GitHub Actions): affected all versions; fixed in 1.13.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/ (Markdown: https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-vxmw-7h4f-hqxh

---
From sbomify Insights: https://insights.sbomify.com/GHSA-vxmw-7h4f-hqxh/
Summaries are generated and may contain mistakes; the official description above is the record.