Zero Radar
← feed
CriticalVulnerabilityGHSA-5xjx-3w67-w9x9updated 30 Oct 2026, 20:24 UTC

PyPI publish action trusted an extra certificate authority it should not have

A tool that uploads Python packages to PyPI was shipping with a certificate that could make it trust connections to fake servers. Old versions could be tricked into sending data to the wrong place.

Fix available · out Official source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes1.14.3 (the emSign root CA was removed from the bundled certifi trust store) · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

The pypi-publish GitHub Action before 1.14.2 bundled the emSign root CA certificate through the certifi package, adding an unnecessary trusted certificate authority to its TLS trust store.

Why it is dangerous: A trusted certificate authority that has been compromised can let an attacker impersonate PyPI or Sigstore services, potentially intercepting package publishing credentials or tampering with uploads. Projects using this action to publish Python packages are at risk.

Are you affected?

You are affected if your workflows use actions/pypa/gh-action-pypi-publish version 1.14.2 or earlier to publish Python packages.

Package / productAffected versionsFixed in
pypa/gh-action-pypi-publish · actions<= 1.14.21.14.3

What to do

  1. Update actions/pypa/gh-action-pypi-publish to version 1.14.3 or later in your workflow files
  2. Review recent PyPI publish runs for unexpected uploads or changes
  3. Rotate any PyPI API tokens or trusted publishing credentials used by affected workflows if compromise is suspected

Timeline

  1. 30 Oct 2026, 20:24 UTC
    Publicly disclosed
  2. 30 Oct 2026, 20:24 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 30 Oct 2026, 20:24 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-5xjx-3w67-w9x9
CVSS
9.3 / 10
Disclosed
30 Oct 2026, 20:24 UTC
On Zero Radar
30 Oct 2026, 20:24 UTC (0 min after disclosure)
Last change
30 Oct 2026, 20:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PyPI publish action trusted an extra certificate authority it should not have · Zero Radar