Secuno
ENNL
Book demo

CVE-2025-47928

Spotipy vulnerability

9.1 CRITICALEPSS 0.60%
  1. Published15 May 2025

Description

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`, `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-864928.5
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant…
CVE-2026-199319.8
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname…
CVE-2026-1632610.0
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state…
CVE-2026-1649810.0
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant…
CVE-2025-12478.3
A flaw was found in Quarkus REST that allows request parameters to leak between…
CVE-2023-19078.0
A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode…

Frequently asked

Is CVE-2025-47928 being actively exploited?

CVE-2025-47928 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.60%.

How severe is CVE-2025-47928?

CVE-2025-47928 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.60% probability of exploitation.

How do I fix CVE-2025-47928?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-47928 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.