Reviewdog
Security incidents tagged Reviewdog. Newest first.
0 Reviewdog incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 577
- Longest quiet run: 577 days (Mar 25–Oct 22)
Show 2 older incidents2 older incidents
March 2025 2
Highreviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityPatched
reviewdog action-setup GitHub Action Patched
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.
Open incident →CVE-2025-30154- CriticalPatched
tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs
Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.
tj-actions/changed-files GitHub ActionClosed Mar 20, 2025
