GHSA-5XJX-3W67-W9X9 pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Summary The pypi-publish actionpypi-publish versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. pypi-publish:...

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Summary The pypi-publish actionpypi-publish versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. pypi-publish:...

GHSA-VXMW-7H4F-HQXH PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps

Summary gh-action-pypi-publish makes use of GitHub Actions expression expansions i.e. $ ... in contexts that are potentially attacker controllable. Depending on the trigger used to invoke gh-action-pypi-publish, this may allow an attacker to execute arbitrary code within the context of a workflow...

PT-2025-37421

Summary gh-action-pypi-publish makes use of GitHub Actions expression expansions i.e. $ ... in contexts that are potentially attacker controllable. Depending on the trigger used to invoke gh-action-pypi-publish, this may allow an attacker to execute arbitrary code within the context of a workflow...

@alauda/custom-webpack (>=4.0.0, <=4.4.0), @glow-app/glow-client (0.3.0) +43 more potentially affected by CVE-2022-33987 via got (>=12.0.0, <=12.0.4)

got NPM version =12.0.0, =4.0.0, =1.0.1, =6.1.1, =11.1.2, =9.2.2, =4.1.2, =4.0.2, =1.0.0, =1.7.0, =0.0.0, =2.1.0, =1.1.0, =1.10.0, =2.5.0, =2.5.1 and more Source cves: CVE-2022-33987 Source advisory: GHSA-PFRX-2Q88-QQ97...