CVE-2025-47928
📋 TL;DR
This CVE describes a GitHub Actions workflow vulnerability in the Spotipy Python library where the pull_request_target event executes untrusted code from pull requests with full access to repository secrets. Attackers could exfiltrate GITHUB_TOKEN and Spotify API credentials, potentially gaining write access to the repository. This affects users who run GitHub Actions workflows with pull_request_target in public repositories.
💻 Affected Systems
- spotipy
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete repository takeover via GITHUB_TOKEN with write privileges, exfiltration of all repository secrets, and potential supply chain compromise.
Likely Case
Exfiltration of GITHUB_TOKEN and Spotify API credentials (SPOTIPY_CLIENT_ID, SPOTIPY_CLIENT_SECRET), enabling unauthorized access to Spotify API and repository manipulation.
If Mitigated
No impact if proper GitHub Actions security practices are followed, including not using pull_request_target with untrusted code execution.
🎯 Exploit Status
Exploitation requires creating a malicious pull request to a vulnerable repository. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f
Vendor Advisory: https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8
Restart Required: No
Instructions:
1. Update to commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f or later. 2. Review and update .github/workflows/integration_tests.yml. 3. Rotate all exposed secrets (GITHUB_TOKEN, SPOTIPY_CLIENT_ID, SPOTIPY_CLIENT_SECRET).
🔧 Temporary Workarounds
Disable pull_request_target workflow
allTemporarily disable or remove the vulnerable workflow file to prevent exploitation.
rm .github/workflows/integration_tests.yml
git commit -m 'Remove vulnerable workflow'
git push
Restrict workflow permissions
allConfigure GitHub Actions to use read-only tokens and limit secret access.
# In workflow YAML, add:
permissions:
contents: read
# Or set specific minimal permissions
🧯 If You Can't Patch
- Rotate all repository secrets immediately (GITHUB_TOKEN, SPOTIPY_CLIENT_ID, SPOTIPY_CLIENT_SECRET)
- Disable GitHub Actions or restrict to trusted contributors only
🔍 How to Verify
Check if Vulnerable:
Check if .github/workflows/integration_tests.yml uses pull_request_target with checkout of head.sha from forked PRs between commits 4f5759dbfb4506c7b6280572a4db1aabc1ac778d and 9dfb7177b8d7bb98a5a6014f8e6436812a47576f.Check Version:
git log --oneline | grep -E '4f5759d|9dfb717'Verify Fix Applied:
Verify workflow file has been updated to commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f or later, and no longer executes untrusted code with secret access.📡 Detection & Monitoring
Log Indicators:
- Unauthorized GitHub Actions workflow runs from forked PRs
- Unexpected secret usage in GitHub audit logs
- Failed authentication attempts with rotated credentials
Network Indicators:
- Outbound connections to unexpected destinations during workflow execution
- API calls to Spotify from unauthorized sources
SIEM Query:
source="github_audit" action="workflow.run" actor_type="User" workflow_name="integration_tests" pull_request_forked=true