[high] reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

Mon, 24 Mar 2025 00:00:00 GMT

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-24: CISA added CVE-2025-30154 to the KEV catalog (due 2025-04-14).

CVEs: CVE-2025-30154

[critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs

Thu, 20 Mar 2025 00:00:00 GMT

Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.

Status: closed · Patch: patched · Fixed in: 46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)

Latest updates:

2025-03-20: tj-actions and reviewdog maintainers finish remediation (source)
2025-03-18: CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too
2025-03-15: GitHub removes the action, then restores a cleaned repository (source)

CVEs: CVE-2025-30066

pwn.watch: Reviewdog incident updates

[high] reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

[critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs