pypa/gh-action-pypi-publish
GitHub Actions · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI | pypa/gh-action-pypi-publish | GitHub Actions | Critical | Fix reported | |
| PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps | pypa/gh-action-pypi-publish | GitHub Actions | Low | Fix reported |