CVE-2025-30066
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4Description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Analysis
tj-actions/changed-files GitHub Action was compromised in a supply chain attack where modified tags pointed to credential-stealing code, exposing secrets from GitHub Actions workflows across thousands of repositories.
Technical Context
The CWE-506 supply chain attack modified existing mutable tags (v1 through v45.0.7) to reference commit 0e58ed8, which contained malicious updateFeatures code. The code extracted environment variables (including secrets) and wrote them to GitHub Actions workflow logs, making them accessible to anyone with read access.
Affected Products
['tj-actions/changed-files tags v1 through v45.0.7 (during March 14-15, 2025)']
Remediation
Pin all GitHub Actions to specific commit SHAs. Rotate ALL secrets that were available to workflows using this action. Audit workflow logs for secret exposure. Use GitHub's allow-listed actions feature.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today