High severity · published Mar 15, 2025
CVE-2025-30066
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
In wildKEV
8.6
CVSS
72.1%
EPSS
Yes
On KEV
Description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)72.1% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 18, 2025
Federal remediation dueApr 8, 2025
Ransomware campaign useNot known
Affected products
Which versions
CH
changed-files · tj-actions
1 before 46 · source: vendor, NVD
CG
changed-files GitHub Action · tj-actions
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30066
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
github.com
https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
github.com
https://github.com/tj-actions/changed-files/issues/2463
www.stepsecurity.io
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
semgrep.dev
https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
news.ycombinator.com
https://news.ycombinator.com/item?id=43368870
web.archive.org
https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463
More from changed-files
9.8
CVE-2023-51664
tj-actions/changed-files command injection in output filenames