Python Library Vulnerability in Spotipy - GitHub Action Exploit Risk

CVE-2025-47928

What is CVE-2025-47928?

The Spotipy library's integration with GitHub Actions has been compromised, allowing attackers to execute untrusted code in the context of the base repository. This vulnerability arises from the use of pull_request_target in the integration tests workflow and can lead to the exfiltration of sensitive secrets, including the GITHUB_TOKEN, SPOTIPY_CLIENT_ID, and SPOTIPY_CLIENT_SECRET. Exploitation may enable attackers to gain write access to the repository. Mitigations were introduced in commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f, which addressed the security lapses present in earlier commits.

References