Vulnerability · Published Jun 19, 2025 · Assigned by GitHub_M

CVE-2025-52467pgai secrets exfiltration via `pull_request_target`

Critical 9.1

In plain English

A critical-severity information exposure in pgai from timescale. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This issue has been patched in commit 8eb3567.

Affected products (as reported)

Vendor	Product	Versions
timescale	pgai	< 8eb356729c33560ce54b88b9a956960ad1e3ede8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/timescale/pgai/security/advisories/GHSA-89qq-hgvp-x37m x_refsource_CONFIRM
https://github.com/timescale/pgai/pull/742 x_refsource_MISC
https://github.com/timescale/pgai/commit/8eb356729c33560ce54b88b9a956960ad1e3ede8 x_refsource_MISC