{"id":"GHSA-5xjx-3w67-w9x9","kind":"vulnerability","aliases":["GHSA-5xjx-3w67-w9x9"],"related":[],"title":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","description":"### Summary\n\nThe [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them.\n\n[pypi-publish]: https://github.com/marketplace/actions/pypi-publish\n\n### Details\n\nThe `certifi`-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations.\n\n### Related\n\nThe external compromise is being tracked at https://emudhra.we-have-a-problem.com","summary":"Versions of the pypi-publish GitHub Action before 1.14.2 bundled the emSign root CA certificate through the certifi package, and that CA is part of the chain Sigstore uses for Trusted Publishing and attestations. The advisory describes the risk as revocation of that CA, so trust in releases signed through that chain could be affected.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pypa/gh-action-pypi-publish","fixed":["1.14.3"],"affected":"<= 1.14.2","ecosystem":"github-actions"}],"ecosystems":["github-actions"],"tags":["cwe-295","github-actions","package","pypi","python","sigstore","trusted-publishing"],"not_affected_if":["no-pypi-publish-action","pinned-1.14.3-or-later"],"how_to_check":"- Check the action version in your workflows: look for `pypa/gh-action-pypi-publish` pinned below `1.14.2`.\n- Search workflow files under `.github/workflows/` for `gh-action-pypi-publish`.","fix":"- `pypa/gh-action-pypi-publish` `1.14.3` (affected versions are `<= 1.14.2`).","status":"open","published_at":"2026-10-30T20:24:24+00:00","first_seen_at":"2026-10-30T20:28:41+00:00","triaged_at":"2026-10-30T20:30:22+00:00","updated_at":"2026-10-30T20:30:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T20:30:22Z","model":"claude-haiku-5-5","output":{"fix":"- `pypa/gh-action-pypi-publish` `1.14.3` (affected versions are `<= 1.14.2`).","reach":"unknown","title":"pypi-publish action: revoked CA in trust store breaks Sigstore publishing","impact":"medium","summary":"Versions of the pypi-publish GitHub Action before 1.14.2 bundled the emSign root CA certificate through the certifi package, and that CA is part of the chain Sigstore uses for Trusted Publishing and attestations. The advisory describes the risk as revocation of that CA, so trust in releases signed through that chain could be affected.","audience":"developers","category":"package","nicknames":[],"who_cares":["github-actions","pypi","python","sigstore","trusted-publishing"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"publishing trust chain breaks; release signing may fail or be distrusted","analyst_note":"Confirm what the emSign CA revocation actually changes for Sigstore verification and whether any attacker-controlled path exists; see the maintainer advisory at github.com/advisories/GHSA-5xjx-3w67-w9x9.","how_to_check":"- Check the action version in your workflows: look for `pypa/gh-action-pypi-publish` pinned below `1.14.2`.\n- Search workflow files under `.github/workflows/` for `gh-action-pypi-publish`.","plain_action":"","needs_analyst":true,"not_affected_if":["pinned-1.14.3-or-later","no-pypi-publish-action"],"who_is_affected":"Projects that publish Python packages to PyPI with the pypi-publish action at version 1.14.2 or earlier, using Trusted Publishing or Sigstore attestations. Workflows that do not use this action, or that already pin 1.14.3 or later, are not affected. The advisory does not state the exact impact beyond the CA revocation risk, and the sources do not give an exploit path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000794,"input_tokens":4349,"output_tokens":718,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-295':34B '/marketplace/actions/pypi-publish':148C '1.14.2':54B,112C '3w67':25A,30A '5xjx':24A,29A 'action':4A,37B,52B,106C 'advisori':81B 'affect':100B 'attest':19A,79B,179C 'bundl':55B,115C,134C 'ca':7A,59B,67B,89B,119C 'certif':60B,122C 'certifi':63B,125C,151C 'chain':10A,72B,97B 'compromis':183C 'could':98B 'cwe':33B 'describ':82B 'detail':149C 'digit':18A,178C 'distribut':126C 'ecosystem':165C 'emsign':57B,117C 'emudhra.we-have-a-problem.com':188C 'extern':182C 'ghsa':23A,28A 'ghsa-5xjx-3w67-w9x9':22A,27A 'github':36B,51B 'github-act':35B 'github.com':147C 'github.com/marketplace/actions/pypi-publish':146C 'includ':141C,166C 'longer':140C 'mani':160C 'new':137C 'packag':38B,64B 'part':69B 'project':161C 'provid':152C 'publish':3A,16A,44B,50B,77B,105C,109C,145C,171C,176C 'pypa/gh-action-pypi-publish':32A 'pypi':2A,21A,39B,49B,104C,108C,144C,170C 'pypi-publish':1A,48B,103C,107C,143C,169C 'python':40B,164C 'relat':180C 'releas':93B 'reli':172C 'remov':131C 'revoc':5A,86B 'risk':84B 'root':58B,118C 'sign':94B 'sigstor':12A,41B,73B,167C 'sinc':129C 'store':121C,155C 'summari':101C 'tls':153C 'track':186C 'trust':15A,43B,76B,91B,120C,154C,175C 'trusted-publish':42B 'typic':157C 'use':13A,74B,113C,158C 'version':45B,110C,138C 'w9x9':26A,31A","nicknames":[],"mitigations":[],"who_affected":"Projects that publish Python packages to PyPI with the pypi-publish action at version 1.14.2 or earlier, using Trusted Publishing or Sigstore attestations. Workflows that do not use this action, or that already pin 1.14.3 or later, are not affected. The advisory does not state the exact impact beyond the CA revocation risk, and the sources do not give an exploit path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T20:24:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-5xjx-3w67-w9x9","url":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","severity":"critical","published_at":"2026-10-30T20:24:24+00:00","modified_at":"2026-10-30T20:24:25+00:00","first_seen_at":"2026-10-30T20:28:41+00:00","fetched_at":"2026-10-30T21:35:30+00:00","note":null}],"documents":[{"id":25820,"url":"https://api.github.com/repos/pypa/gh-action-pypi-publish/security-advisories/GHSA-5xjx-3w67-w9x9","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":25821,"url":"https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}