CVE-2025-30154
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5Tags
Description
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Analysis
reviewdog/action-setup GitHub Action was compromised with malicious code that dumped CI/CD secrets to workflow logs, affecting all reviewdog actions that depend on this setup action.
Technical Context
The CWE-506 supply chain attack injected secret-exfiltration code into the setup action. Since multiple reviewdog actions (action-shellcheck, action-eslint, etc.) depend on action-setup@v1, all downstream actions were also compromised.
Affected Products
['reviewdog/action-setup@v1 (March 11, 2025, 18:42-20:31 UTC)', 'All reviewdog actions using action-setup@v1']
Remediation
Pin all GitHub Actions to commit SHAs. Rotate secrets exposed during the compromise window. Audit workflow logs for unauthorized output.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today