CVE-2025-47271: OZI GitHub Action RCE Vulnerability

CVE-2025-47271 is a remote code execution vulnerability in OZI GitHub Action that allows malicious actors to inject arbitrary code through crafted branch names. This article covers technical details, affected versions 1.13.2-1.13.5, impact assessment, and mitigation strategies including upgrading to version 1.13.6.

CVE-2025-47271 Overview

CVE-2025-47271 affects the OZI-Project publish GitHub Action, a workflow component that publishes releases to PyPI along with mirror releases, signature bundles, and provenance data. Versions 1.13.2 through 1.13.5 pass untrusted data into pull request creation logic without proper sanitization. An attacker who can influence a branch name can inject arbitrary code into the workflow context. The maintainers addressed the flaw in version 1.13.6. The weakness is categorized as Improper Control of Generation of Code [CWE-94].

Critical Impact
A malicious branch name can trigger arbitrary code execution inside the GitHub Actions runner, exposing repository secrets, publishing credentials, and PyPI release integrity.

Affected Products

OZI-Project publish GitHub Action version 1.13.2
OZI-Project publish GitHub Action versions 1.13.3 through 1.13.4
OZI-Project publish GitHub Action version 1.13.5

Discovery Timeline

2025-05-12 - CVE-2025-47271 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47271

Vulnerability Analysis

The publish action executes as part of the OZI release workflow and interacts with GitHub pull request APIs. During PR creation logic, it interpolates values derived from the source branch name into strings that are later evaluated by the runner. Because branch names are attacker-controllable in forks and pull requests, the injected content is treated as executable expression syntax rather than inert text. The result is code execution in the context of the GitHub Actions job.

This pattern is characteristic of GitHub Actions script injection, where untrusted context such as github.head_ref or github.event.pull_request.head.ref flows into shell scripts or JavaScript expressions. Once code runs in the workflow, it can read repository secrets exposed to the job, including PyPI publishing tokens and signing material.

Root Cause

The root cause is missing sanitization of branch name input before it reaches an expression evaluator inside the action logic. The affected code paths treat GitHub-supplied metadata as trusted, violating the least-trust boundary between event payloads and workflow execution.

Attack Vector

An attacker forks the repository, creates a branch whose name contains injected expression or shell syntax, and opens a pull request. When the OZI publish workflow runs against that PR, the malicious branch name is expanded and executed. See the GitHub Security Advisory GHSA-2487-9f55-2vg9 and the fix commit abd8524 for the technical fix.

Detection Methods for CVE-2025-47271

Indicators of Compromise

Pull requests originating from forks with unusual branch names containing backticks, ${{, $(, or shell metacharacters.
Unexpected outbound network connections from GitHub Actions runners executing the OZI publish workflow.
Unplanned PyPI releases, signature bundles, or provenance artifacts published outside of normal release cadence.

Detection Strategies

Audit workflow run logs for the OZI publish action and correlate head_ref values with executed commands.
Enumerate repositories using OZI-Project publish at versions 1.13.2 through 1.13.5 via dependency scanning of .github/workflows/*.yml files.
Review PyPI project audit logs for release publications that do not correspond to a maintainer-approved tag.

Monitoring Recommendations

Enable GitHub Actions workflow run notifications and forward logs to a central SIEM for review.
Monitor secret access events and token usage within Actions runners for anomalies.
Alert on new pull requests from forks that trigger release-publishing workflows.

How to Mitigate CVE-2025-47271

Immediate Actions Required

Upgrade the OZI-Project publish action to version 1.13.6 or later in all .github/workflows files that reference it.
Rotate any PyPI API tokens, signing keys, and repository secrets exposed to the vulnerable workflow.
Restrict pull-request-triggered publishing workflows so they do not run automatically on untrusted forks.

Patch Information

The issue is patched in OZI-Project publish version 1.13.6. The fix is committed in abd8524ec69800890529846b3ccfb09ce7c10b5c and documented in GHSA-2487-9f55-2vg9.

Workarounds

Downgrade to a version prior to 1.13.2 if immediate upgrade to 1.13.6 is not feasible.
Assign untrusted branch context values to an intermediate environment variable before use, avoiding direct expression interpolation.
Require maintainer approval before workflows run on pull requests from first-time or external contributors.

bash

# Pin the patched version in your workflow
# .github/workflows/release.yml
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: OZI-Project/publish@1.13.6