Changed Files CVE-2025-30066
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionNVD
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
AnalysisAI
tj-actions/changed-files GitHub Action was compromised in a supply chain attack where modified tags pointed to credential-stealing code, exposing secrets from GitHub Actions workflows across thousands of repositories.
Technical ContextAI
The CWE-506 supply chain attack modified existing mutable tags (v1 through v45.0.7) to reference commit 0e58ed8, which contained malicious updateFeatures code. The code extracted environment variables (including secrets) and wrote them to GitHub Actions workflow logs, making them accessible to anyone with read access.
RemediationAI
Pin all GitHub Actions to specific commit SHAs. Rotate ALL secrets that were available to workflows using this action. Audit workflow logs for secret exposure. Use GitHub's allow-listed actions feature.
Share
External POC / Exploit Code
Leaving vuln.today