{"matches":[{"vulnerability":{"id":"GHSA-5xjx-3w67-w9x9","dataSource":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","namespace":"github:language:github-action","severity":"Critical","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9"],"description":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"fix":{"versions":["1.14.3"],"state":"fixed","available":[{"version":"1.14.3","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"release/v1"}},"found":{"vulnerabilityID":"GHSA-5xjx-3w67-w9x9","versionConstraint":"<=1.14.2 (unknown)"},"fix":{"suggestedVersion":"1.14.3"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@release%2Fv1?package-id=57f735bc539a6dc9","name":"pypa/gh-action-pypi-publish","version":"release/v1","type":"github-action","locations":[{"path":"/.github/workflows/cd.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@release%2Fv1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=ebb52d3edc793930","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/cd.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=3a6ece1494f754ae","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/reusable-build.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxmw-7h4f-hqxh","dataSource":"https://github.com/advisories/GHSA-vxmw-7h4f-hqxh","namespace":"github:language:github-action","severity":"Low","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-vxmw-7h4f-hqxh","https://github.com/pypa/gh-action-pypi-publish/commit/77db1b7cf7dcea2e403bb4350516284282740dd6"],"description":"PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"exploitabilityScore":3.9,"impactScore":0},"vendorMetadata":{}}],"fix":{"versions":["1.13.0"],"state":"fixed","available":[{"version":"1.13.0","date":"2025-09-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"release/v1"}},"found":{"vulnerabilityID":"GHSA-vxmw-7h4f-hqxh","versionConstraint":"<1.13.0 (unknown)"},"fix":{"suggestedVersion":"1.13.0"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@release%2Fv1?package-id=57f735bc539a6dc9","name":"pypa/gh-action-pypi-publish","version":"release/v1","type":"github-action","locations":[{"path":"/.github/workflows/cd.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:release\\/v1:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:release\\/v1:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@release%2Fv1","upstreams":[]}}],"source":{"type":"file","target":"pyupio/safety"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:48.01109483Z"}}