Vulnerability in pgai Python Library Affecting Timescale

CVE-2025-52467

What is CVE-2025-52467?

The pgai library, which facilitates PostgreSQL transformations for retrieval in RAG and Agentic applications, had a vulnerability that allowed attackers to extract sensitive secrets from workflows. This included the GITHUB_TOKEN with write permissions, granting full access to manipulate repository contents, push arbitrary code, and release changes. The issue was resolved in commit 8eb3567, reinforcing the need for users to update their installations to prevent potential exploitation.

References