CVE-2025-52467: pgai Information Disclosure Vulnerability

CVE-2025-52467 Overview

CVE-2025-52467 is a critical Information Exposure vulnerability affecting the pgai Python library, which transforms PostgreSQL into a retrieval engine for RAG (Retrieval-Augmented Generation) and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in GitHub Actions workflows, including the GITHUB_TOKEN with write permissions. This vulnerability could allow attackers to tamper with all aspects of the repository, including pushing arbitrary code and malicious releases.

Critical Impact
An attacker could exfiltrate sensitive GitHub workflow secrets including the GITHUB_TOKEN with write permissions, enabling complete repository compromise including arbitrary code injection and malicious release publication.

Affected Products

pgai (Python library) - versions prior to commit 8eb3567
Timescale pgai GitHub repository workflows

Discovery Timeline

2025-06-19 - CVE-2025-52467 published to NVD
2025-06-23 - Last updated in NVD database

Technical Details for CVE-2025-52467

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw existed in the GitHub Actions workflow configuration within the pgai repository, which improperly exposed workflow secrets to potentially untrusted contexts. The vulnerability is network-exploitable without requiring any user interaction or special privileges, making it particularly dangerous for supply chain attacks.

The impact is severe because the exposed GITHUB_TOKEN possessed write permissions to the repository. With this token, an attacker could modify repository contents, create or modify releases, alter workflow configurations, and inject malicious code that would then be distributed to downstream users of the pgai library.

Root Cause

The root cause of this vulnerability lies in the insecure configuration of GitHub Actions workflows in the pgai repository. The workflow implementation failed to properly restrict access to sensitive secrets, allowing them to be exfiltrated through crafted inputs or workflow manipulations. This is a common vulnerability pattern in CI/CD pipelines where secrets are inadvertently exposed to untrusted code execution contexts, such as pull request workflows from forked repositories.

Attack Vector

The attack vector for CVE-2025-52467 is network-based and exploits the GitHub Actions workflow configuration. An attacker could potentially trigger the vulnerable workflow and extract the GITHUB_TOKEN along with other workflow secrets. Once obtained, the write-permission token grants the attacker full control over repository operations.

The attack flow involves:

Identifying the vulnerable workflow configuration in the pgai repository
Triggering the workflow in a manner that exposes secrets to an attacker-controlled context
Capturing the exfiltrated GITHUB_TOKEN and other secrets
Using the token to push malicious code, create backdoored releases, or modify existing repository content

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-89qq-hgvp-x37m.

Detection Methods for CVE-2025-52467

Indicators of Compromise

Unexpected or unauthorized commits to the pgai repository from unknown actors
Unusual GitHub Actions workflow execution patterns or logs showing secret access
New or modified releases that were not officially announced by Timescale
Unauthorized modifications to workflow files (.github/workflows/)
Evidence of token usage from unexpected IP addresses in GitHub audit logs

Detection Strategies

Review GitHub audit logs for the pgai repository for any suspicious token usage or unauthorized API calls
Monitor for unexpected changes to workflow configurations or repository content
Implement branch protection rules and require code reviews for all changes
Audit GitHub Actions workflow permissions and secret access patterns
Use GitHub's secret scanning alerts to detect any exposed credentials

Monitoring Recommendations

Enable GitHub Advanced Security features including secret scanning and code scanning
Configure alerts for workflow configuration changes in sensitive repositories
Implement monitoring for unusual commit patterns or release publications
Review dependency trees for any unexpected versions of pgai being pulled
Set up automated notifications for security advisory publications related to pgai

How to Mitigate CVE-2025-52467

Immediate Actions Required

Update the pgai repository to include commit 8eb3567 or later which contains the security fix
Rotate all GitHub tokens and secrets that may have been exposed in the vulnerable workflow
Audit repository history for any unauthorized commits or changes made during the vulnerable period
Review and verify the integrity of any releases published before the patch
Implement strict workflow permissions following the principle of least privilege

Patch Information

The vulnerability has been patched in commit 8eb3567. Users and maintainers should ensure they are using a version of the repository that includes this fix. The patch addresses the insecure workflow configuration that allowed secret exfiltration.

Relevant patch resources:

Workarounds

Restrict workflow permissions by setting permissions: in workflow files with minimal required access
Use environment protection rules to require approvals before secrets are accessible
Avoid running workflows with write permissions on pull requests from forks
Implement CODEOWNERS to require specific team reviews for workflow file changes
Consider using fine-grained personal access tokens instead of GITHUB_TOKEN where possible

bash

# Example workflow permissions restriction
# Add to .github/workflows/*.yml files
permissions:
  contents: read
  pull-requests: read
  # Explicitly deny write access unless absolutely required