What is GHSA-5xjx-3w67-w9x9?

GHSA-5xjx-3w67-w9x9 is a security advisory published by GitHub Security Advisories with Critical severity. pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Why does GHSA-5xjx-3w67-w9x9 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-5xjx-3w67-w9x9?

GHSA-5xjx-3w67-w9x9 affects 1 product, including: actions/pypa/gh-action-pypi-publish:\u003c= 1.14.2.

GHSA-5xjx-3w67-w9x9CriticalDisclosed before NVD

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

📋 Description

Summary

The pypi-publish action versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them.

Details

The certifi-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that pypi-publish relies on for Trusted Publishing and Digital Attestations.

The external compromise is being tracked at https://emudhra.we-have-a-problem.com

🎯 Affected products1

actions/pypa/gh-action-pypi-publish:<= 1.14.2

🔗 References (2)

https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9
https://github.com/advisories/GHSA-5xjx-3w67-w9x9

📋 Description

Summary

Details

Related

🎯 Affected products1

🔗 References (2)