CVE-2025-30066

KEVtj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

Description

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

PublishedMar 15, 2025

Last modifiedSep 24, 2026

Added to KEVMar 18, 2025

Remediation dueApr 8, 2025

References

blog.gitguardian.com/compromised-tj-actions/ExploitThird Party Advisory
github.com/chains-project/maven-lockfile/pull/1111Issue Tracking
github.com/espressif/arduino-esp32/issues/11127Issue Tracking
github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1Product
github.com/modal-labs/modal-examples/issues/1100Issue Tracking
github.com/rackerlabs/genestack/pull/903Issue Tracking
github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1Product
github.com/tj-actions/changed-files/issues/2463Issue Tracking
github.com/tj-actions/changed-files/issues/2464Issue Tracking
github.com/tj-actions/changed-files/issues/2477Issue Tracking
news.ycombinator.com/item?id=43367987Issue TrackingThird Party Advisory
news.ycombinator.com/item?id=43368870Issue TrackingThird Party Advisory

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 567 days
CVSS: 8.6 HIGH
EPSS (30-day exploit probability): 72.1% · top 1% of all CVEs
Weakness: CWE-506
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.