QwikSec

Security Database

CVE

CWE

Training

CVE-2025-47271

Published: May 12, 2025

Modified: May 12, 2025

PUBLISHED

Description

The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2.

Vendor	Product	Versions
OZI-Project	publish	affected `>= 1.13.2, < 1.13.6`

Weaknesses (CWE)

References

https://github.com/OZI-Project/publish/security/advisories/GHSA-2487-9f55-2vg9

x_refsource_CONFIRM

https://github.com/OZI-Project/publish/commit/abd8524ec69800890529846b3ccfb09ce7c10b5c

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.