GHSA-5xjx-3w67-w9x9Critical▾ Midnightpypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The pypi-publish action versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them.
The certifi-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that pypi-publish relies on for Trusted Publishing and Digital Attestations.
The external compromise is being tracked at https://emudhra.we-have-a-problem.com
pypa/gh-action-pypi-publish <= 1.14.2Upgrade to a patched release:
pypa/gh-action-pypi-publish 1.14.3Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14022High· 7.7LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK
CVE-2021-20327Medium· 6.4A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate
CVE-2018-0227High· 7.5A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to establish an SSL VPN…
CVE-2026-1531High· 8.1A flaw was found in foreman_kubevirt
CVE-2026-1530High· 8.1A flaw was found in fog-kubevirt
CVE-2026-102938Medium· 5.8virtualenv is a tool for creating isolated virtual python environments