« Volver al listado

CVE-2025-47928

Estado: AplazadaCrítica (9.1)—

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`, `SPOTIPY_CLIENT_SECRET`.

Leer descripción completaMostrar menos

In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de configuración en GitHub Actions (pull_request_target) que permite ejecutar código no confiable con acceso a secrets del repositorio; riesgo crítico de exfiltración de credenciales (GITHUB_TOKEN, CLIENT_ID/SECRET).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Spotipy — SpotipyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47928",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47928",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-15T20:17:02.996955Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "spotipy-dev",
          "product": "spotipy",
          "versions": [
            {
              "status": "affected",
              "version": "= 4f5759dbfb4506c7b6280572a4db1aabc1ac778d"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-15T20:16:09.650",
  "references": [
    {
      "url": "https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`,  `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue."
    },
    {
      "lang": "es",
      "value": "Spotipy es una librería de Python para la API web de Spotify. A partir de el commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, el uso de `pull_request_target` en `.github/workflows/integration_tests.yml` seguido de la verificación del archivo head.sha de una solicitud de integración bifurcada puede ser explotado por atacantes, ya que se puede ejecutar código no confiable con acceso completo a los secretos (del repositorio base). Al explotar esta vulnerabilidad, es posible exfiltrar `GITHUB_TOKEN` y los secretos `SPOTIPY_CLIENT_ID` y `SPOTIPY_CLIENT_SECRET`. En particular, `GITHUB_TOKEN` puede usarse para controlar completamente el repositorio, ya que el token tiene permisos de escritura de contenido. El `pull_request_target` en GitHub Actions es un problema de seguridad importante, especialmente en repositorios públicos, ya que ejecuta código no confiable desde una solicitud de solicitud (PR), pero con el contexto del repositorio base, incluido el acceso a sus secretos. El commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f revirtió el cambio que causó el problema."
    }
  ],
  "lastModified": "2026-06-17T09:28:50.923",
  "sourceIdentifier": "security-advisories@github.com"
}