{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:54:42.548Z",
  "tag": {
    "id": "reviewdog",
    "label": "Reviewdog",
    "isStack": false,
    "url": "https://pwn.watch/t/reviewdog",
    "feed": "https://pwn.watch/t/reviewdog/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "reviewdog-action-setup-github-action-cve-2025-30154",
      "title": "reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability",
      "url": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154",
      "json": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "reviewdog action-setup GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "reviewdog",
        "github",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30154"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-24",
      "closedAt": "2025-03-24",
      "updatedAt": "2025-03-24",
      "summary": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.",
      "xPost": null
    },
    {
      "slug": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "title": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066",
      "json": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "tj-actions/changed-files GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "tj-actions",
        "reviewdog",
        "github",
        "coinbase",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30066"
      ],
      "affectedVersions": [
        "tj-actions/changed-files through 45.0.7 (tags repointed March 14-15, 2025)"
      ],
      "fixedVersions": [
        "46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)"
      ],
      "startedAt": "2025-03-14",
      "closedAt": "2025-03-20",
      "updatedAt": "2025-03-20",
      "summary": "Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "reviewdog-action-setup-github-action-cve-2025-30154",
      "incidentTitle": "reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-24",
      "title": "CISA added CVE-2025-30154 to the KEV catalog (due 2025-04-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-20",
      "title": "tj-actions and reviewdog maintainers finish remediation",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-18",
      "title": "CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-15",
      "title": "GitHub removes the action, then restores a cleaned repository",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "Coinbase agentkit runs the malicious action and leaks a write token (15:10 UTC)",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "All tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-11",
      "title": "Malicious commit pushed to reviewdog/action-setup v1 tag",
      "body": "Reverted about two hours later.",
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    }
  ]
}