Action Ast Grep CVE-2025-30154
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionNVD
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v1 that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
AnalysisAI
reviewdog/action-setup GitHub Action was compromised with malicious code that dumped CI/CD secrets to workflow logs, affecting all reviewdog actions that depend on this setup action.
Technical ContextAI
The CWE-506 supply chain attack injected secret-exfiltration code into the setup action. Since multiple reviewdog actions (action-shellcheck, action-eslint, etc.) depend on action-setup@v1, all downstream actions were also compromised.
RemediationAI
Pin all GitHub Actions to commit SHAs. Rotate secrets exposed during the compromise window. Audit workflow logs for unauthorized output.
Share
External POC / Exploit Code
Leaving vuln.today