UBUNTU-CVE-2025-47928

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-47928
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47928.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-47928
Related
Published
2025-05-15T20:16:00Z
Modified
2025-05-21T16:55:10Z
Summary
[none]
Details

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pull_request_target on .github/workflows/integration_tests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN and secrets SPOTIPY_CLIENT_ID, SPOTIPY_CLIENT_SECRET. In particular GITHUB_TOKEN which can be used to completely overtake the repo since the token has content write privileges. The pull_request_target in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue.

References

Affected packages

Ubuntu:24.10 / spotipy

Package

Name
spotipy
Purl
pkg:deb/ubuntu/spotipy@2.24.0-2?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.24.0-1
2.24.0-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:25.04 / spotipy

Package

Name
spotipy
Purl
pkg:deb/ubuntu/spotipy@2.25.1-1?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.24.0-2
2.25.0-1
2.25.1-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}