CVE-2025-52467: pgai Information Disclosure Vulnerability

CVE-2025-52467 Overview

CVE-2025-52467 is a critical Information Exposure vulnerability affecting the pgai Python library, which transforms PostgreSQL into a retrieval engine for RAG (Retrieval-Augmented Generation) and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in GitHub Actions workflows, including the GITHUB_TOKEN with write permissions. This vulnerability could allow attackers to tamper with all aspects of the repository, including pushing arbitrary code and malicious releases.

Critical Impact

An attacker could exfiltrate sensitive GitHub workflow secrets including the GITHUB_TOKEN with write permissions, enabling complete repository compromise including arbitrary code injection and malicious release publication.

Affected Products

• pgai (Python library) - versions prior to commit 8eb3567
• Timescale pgai GitHub repository workflows

Discovery Timeline

• 2025-06-19 - CVE-2025-52467 published to NVD
• 2025-06-23 - Last updated in NVD database

Technical Details for CVE-2025-52467

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw existed in the GitHub Actions workflow configuration within the pgai repository, which improperly exposed workflow secrets to potentially untrusted contexts. The vulnerability is network-exploitable without requiring any user interaction or special privileges, making it particularly dangerous for supply chain attacks.

The impact is severe because the exposed GITHUB_TOKEN possessed write permissions to the repository. With this token, an attacker could modify repository contents, create or modify releases, alter workflow configurations, and inject malicious code that would then be distributed to downstream users of the pgai library.

Root Cause

The root cause of this vulnerability lies in the insecure configuration of GitHub Actions workflows in the pgai repository. The workflow implementation failed to properly restrict access to sensitive secrets, allowing them to be exfiltrated through crafted inputs or workflow manipulations. This is a common vulnerability pattern in CI/CD pipelines where secrets are inadvertently exposed to untrusted code execution contexts, such as pull request workflows from forked repositories.

Attack Vector

The attack vector for CVE-2025-52467 is network-based and exploits the GitHub Actions workflow configuration. An attacker could potentially trigger the vulnerable workflow and extract the GITHUB_TOKEN along with other workflow secrets. Once obtained, the write-permission token grants the attacker full control over repository operations.

The attack flow involves:

1. Identifying the vulnerable workflow configuration in the pgai repository
2. Triggering the workflow in a manner that exposes secrets to an attacker-controlled context
3. Capturing the exfiltrated GITHUB_TOKEN and other secrets
4. Using the token to push malicious code, create backdoored releases, or modify existing repository content

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-89qq-hgvp-x37m.

Detection Methods for CVE-2025-52467

Indicators of Compromise

• Unexpected or unauthorized commits to the pgai repository from unknown actors
• Unusual GitHub Actions workflow execution patterns or logs showing secret access
• New or modified releases that were not officially announced by Timescale
• Unauthorized modifications to workflow files (.github/workflows/)
• Evidence of token usage from unexpected IP addresses in GitHub audit logs

Detection Strategies

• Review GitHub audit logs for the pgai repository for any suspicious token usage or unauthorized API calls
• Monitor for unexpected changes to workflow configurations or repository content
• Implement branch protection rules and require code reviews for all changes
• Audit GitHub Actions workflow permissions and secret access patterns
• Use GitHub's secret scanning alerts to detect any exposed credentials

Monitoring Recommendations

• Enable GitHub Advanced Security features including secret scanning and code scanning
• Configure alerts for workflow configuration changes in sensitive repositories
• Implement monitoring for unusual commit patterns or release publications
• Review dependency trees for any unexpected versions of pgai being pulled
• Set up automated notifications for security advisory publications related to pgai

How to Mitigate CVE-2025-52467

Immediate Actions Required

• Update the pgai repository to include commit 8eb3567 or later which contains the security fix
• Rotate all GitHub tokens and secrets that may have been exposed in the vulnerable workflow
• Audit repository history for any unauthorized commits or changes made during the vulnerable period
• Review and verify the integrity of any releases published before the patch
• Implement strict workflow permissions following the principle of least privilege

Patch Information

The vulnerability has been patched in commit 8eb3567. Users and maintainers should ensure they are using a version of the repository that includes this fix. The patch addresses the insecure workflow configuration that allowed secret exfiltration.

Relevant patch resources:

• GitHub Commit 8eb3567
• GitHub Pull Request #742
• GitHub Security Advisory GHSA-89qq-hgvp-x37m

Workarounds

• Restrict workflow permissions by setting permissions: in workflow files with minimal required access
• Use environment protection rules to require approvals before secrets are accessible
• Avoid running workflows with write permissions on pull requests from forks
• Implement CODEOWNERS to require specific team reviews for workflow file changes
• Consider using fine-grained personal access tokens instead of GITHUB_TOKEN where possible

# Example workflow permissions restriction
# Add to .github/workflows/*.yml files
permissions:
  contents: read
  pull-requests: read
  # Explicitly deny write access unless absolutely required