Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://github.com/marketplace/actions/pypi-publish Details The certifi-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations. Related The external compromise is being tracked at https://emudhra.we-have-a-problem.com
Recommended action: Upgrade to 1.14.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
gh-action-pypi-publish makes use of GitHub Actions expression expansions (i.e. ${{ ... }}) in contexts that are potentially attacker controllable. Depending on the trigger used to invoke gh-action-pypi-publish, this may allow an attacker to execute arbitrary code within the context of a workflow step that invokes gh-action-pypi-publish. Details gh-action-pypi-publish contains a composite action step, set-repo-and-ref, that makes use of expression expansions: Permalink: https://github.com/pypa/gh-action-pypi-publish/blob/db8f07d3871a0a180efa06b95d467625c19d5d5f/action.yml#L114-L125 In normal intended operation, these expansions are used to establish a correct priority for outputs like ref and repo-id. However, these expansions have a side effect: because they're done with ${{ ... }} and not with ${...} (i.e. normal shell interpolation), they can bypass normal shell quoting rules. In particular, if both env.ACTIONREF and env.PRREF evaluate to empty strings, then the expression…
Recommended action: Upgrade to 1.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.