Target Industry
Indiscriminate, opportunistic targeting.
Overview
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert on a new vulnerability in GitHub Actions. The vulnerability is a supply–chain compromise involving third-party GitHub Actions. This has been tracked as CVE-2025-30066 and has been added to the Known Exploited Vulnerabilities (KEV) catalogue.
Impact
CVE-2025-30066 (CVSS score 8.6) has a significant impact and is actively being exploited. It allows threat actors to access sensitive data through action logs. The vulnerability affects versions of the tj-actions/changed-files GitHub Action up to and including 45.0.7.
Exploitation
The CVE-2025-30066 vulnerability is exploited through a progressive supply-chain attack. Initially, threat actors compromised the “reviewdog/action-setup@v1” GitHub Action by injecting malicious code to dump CI/CD secrets into log files. This compromised action was then used by the “tj-actions/changed-files” GitHub Action, leading to the exposure of sensitive data such as access keys and tokens.
The compromised GitHub Action was incorporated into the “tj-actions/changed-files” GitHub Action, allowing threat actors to access and expose sensitive data, such as access keys and tokens. Additionally, the threat actors inserted a base64-encoded payload into the install.sh script, causing secrets from affected CI workflows to be exposed in public repositories. This includes secrets such as valid access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys.
Containment, Mitigations & Remediation
It is highly recommended to update to the latest version of tj-actions/changed-files by Friday 4th April 2025. CISA has also provided guidance on strengthening security when using third-party actions. Please read CISA’s Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 | CISA alert.
Indicators of Compromise
Several GitHub Actions from the same developer (reviewdog) may be affected by the same or similar vulnerabilities. These potentially impacted actions include:
- reviewdog/action-setup@v1
- reviewdog/action-shellcheck
- reviewdog/action-composite-template
- reviewdog/action-staticcheck
- reviewdog/action-ast-grep
- reviewdog/action-typos.
Threat Landscape
GitHub Actions is widely used by developers and organisations around the world. As of the latest data, millions of repositories on GitHub utilise GitHub Actions for automating workflows, CI/CD processes, and other tasks. This vulnerability highlights the growing threat to supply chain security.
Threat Group
The specific threat group behind this has not been publicly identified at the time of writing.
Further Information
