CVE-2025-52467
Last modified
CVE-2025-52467 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This issue has been patched in commit 8eb3567.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-52467?
How severe is CVE-2025-52467?
How do I fix CVE-2025-52467?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-52460Files or directories accessible to external parties issue ex…6.9
- CVE-2025-52461An out-of-bounds read vulnerability exists in the Nex parsin…9.1
- CVE-2025-52462Cross-site scripting vulnerability exists in Active! mail 6 …6.1
- CVE-2025-52463Cross-site request forgery vulnerability exists in Active! m…3.1
- CVE-2025-52464Meshtastic is an open source mesh networking solution. In ve…8.3
- CVE-2025-52465GeoServer is an open source server that allows users to shar…7.2
- CVE-2025-52468Chamilo is a learning management system. Prior to version 1.…6.1
- CVE-2025-52469Chamilo is a learning management system. Prior to version 1.…7.1
- CVE-2025-5247A vulnerability, which was classified as critical, has been …7.3
- CVE-2025-52470Chamilo is a learning management system. Prior to version 1.…4.8
- CVE-2025-52471ESF-IDF is the Espressif Internet of Things (IOT) Developmen…9.8
- CVE-2025-52472XWiki Platform is a generic wiki platform offering runtime s…9.3
Are you affected by CVE-2025-52467?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST