{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-47928", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-05-14T10:32:43.528Z", "datePublished": "2025-05-15T20:09:48.326Z", "dateUpdated": "2025-05-15T20:18:00.369Z"}, "containers": {"cna": {"title": "Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`", "problemTypes": [{"descriptions": [{"cweId": "CWE-488", "lang": "en", "description": "CWE-488: Exposure of Data Element to Wrong Session", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8"}, {"name": "https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d", "tags": ["x_refsource_MISC"], "url": "https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d"}, {"name": "https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f", "tags": ["x_refsource_MISC"], "url": "https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f"}], "affected": [{"vendor": "spotipy-dev", "product": "spotipy", "versions": [{"version": "= 4f5759dbfb4506c7b6280572a4db1aabc1ac778d", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-05-15T20:09:48.326Z"}, "descriptions": [{"lang": "en", "value": "Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`,  `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern\u2014especially in public repositories\u2014because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue."}], "source": {"advisory": "GHSA-h25v-8c87-rvm8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-15T20:17:02.996955Z", "id": "CVE-2025-47928", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T20:18:00.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47928", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-15T20:17:02.996955Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T20:17:47.852Z"}}], "cna": {"title": "Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`", "source": {"advisory": "GHSA-h25v-8c87-rvm8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "spotipy-dev", "product": "spotipy", "versions": [{"status": "affected", "version": "= 4f5759dbfb4506c7b6280572a4db1aabc1ac778d"}]}], "references": [{"url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8", "name": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d", "name": "https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f", "name": "https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`,  `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern\u2014especially in public repositories\u2014because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-05-15T20:09:48.326Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47928", "state": "PUBLISHED", "dateUpdated": "2025-05-15T20:18:00.369Z", "dateReserved": "2025-05-14T10:32:43.528Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-05-15T20:09:48.326Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`,  `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern\u2014especially in public repositories\u2014because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue."}, {"lang": "es", "value": "Spotipy es una librer\u00eda de Python para la API web de Spotify. A partir de el commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, el uso de `pull_request_target` en `.github/workflows/integration_tests.yml` seguido de la verificaci\u00f3n del archivo head.sha de una solicitud de integraci\u00f3n bifurcada puede ser explotado por atacantes, ya que se puede ejecutar c\u00f3digo no confiable con acceso completo a los secretos (del repositorio base). Al explotar esta vulnerabilidad, es posible exfiltrar `GITHUB_TOKEN` y los secretos `SPOTIPY_CLIENT_ID` y `SPOTIPY_CLIENT_SECRET`. En particular, `GITHUB_TOKEN` puede usarse para controlar completamente el repositorio, ya que el token tiene permisos de escritura de contenido. El `pull_request_target` en GitHub Actions es un problema de seguridad importante, especialmente en repositorios p\u00fablicos, ya que ejecuta c\u00f3digo no confiable desde una solicitud de solicitud (PR), pero con el contexto del repositorio base, incluido el acceso a sus secretos. El commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f revirti\u00f3 el cambio que caus\u00f3 el problema."}], "id": "CVE-2025-47928", "lastModified": "2025-05-16T14:42:18.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-05-15T20:16:09.650", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d"}, {"source": "security-advisories@github.com", "url": "https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f"}, {"source": "security-advisories@github.com", "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-488"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}