Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066

A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including, but not limited to, valid access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA keys. This has been patched in v46.0.1. 

(Updated March 19, 2025) The compromise of tj-actions/changed-files was potentially due to a similar compromise of another GitHub Action, reviewdog/action-setup@v1 (tracked as CVE-2025-30154), which occurred around the same time. The following Actions may also be affected:  

• reviewdog/action-shellcheck

• reviewdog/action-composite-template

• reviewdog/action-staticcheck

• reviewdog/action-ast-grep

• reviewdog/action-typos

CISA added CVE-2025-30066 to its Known Exploited Vulnerabilities Catalog. 

CISA strongly urges users to implement the recommendations to mitigate this compromise and strengthen security when using third-party actions.  

See the following resources for more guidance: 

• GitHub: tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs

• GitHub: Security hardening for GitHub Actions – GitHub Docs

• GitHub: tj-actions/changed-files: :octocat: Github action to retrieve all (added, copied, modified, deleted, renamed, type changed, unmerged, unknown) files and directories

• StepSecurity: Harden-Runner detection: tj-actions/changed-files action is compromised

• Wiz: GitHub Action tj-actions/changed-files supply chain attack
• (Updated March 19, 2025) GitHub: Multiple Reviewdog actions were compromised during a specific time period · CVE-2025-30154 · GitHub Advisory Database

Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870.  

This alert is provided “as is” for informational purposes only. CISA does not provide any warranties of any kind regarding any information within. CISA does not endorse any commercial product, entity, or service referenced in this alert or otherwise. 

Source link