GHSA-5xjx-3w67-w9x9

Suggest an improvement
Source
https://github.com/advisories/GHSA-5xjx-3w67-w9x9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5xjx-3w67-w9x9/GHSA-5xjx-3w67-w9x9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5xjx-3w67-w9x9
Published
2026-10-30T20:24:24Z
Modified
2026-10-30T20:30:05Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
Details

Summary

The pypi-publish action versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them.

Details

The certifi-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that pypi-publish relies on for Trusted Publishing and Digital Attestations.

Related

The external compromise is being tracked at https://emudhra.we-have-a-problem.com

Database specific 
{
    "cwe_ids":  [
        "CWE-295"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-30T20:24:24Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

GitHub Actions / pypa/gh-action-pypi-publish

Package

Name
pypa/gh-action-pypi-publish

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.14.3
Type
GIT
Repo
https://github.com/pypa/gh-action-pypi-publish
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7245906fb61fa33a13554f9d5fb856fe61758086

Affected versions

v1.*
v1.0.0a0
v1.1.0
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.13.0
v1.14.0
v1.14.1
v1.14.2
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.10
v1.8.11
v1.8.12
v1.8.13
v1.8.14
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0

Database specific

last_known_affected_version_range 
"<= 1.14.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5xjx-3w67-w9x9/GHSA-5xjx-3w67-w9x9.json"