CVE-2025-30066

View on CVE.org
Published Mar 15, 2025 CVSS 3.1 · 8.6 High EPSS 72.1% KEV · Listed
Description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-mrrh-fwg8-r2c3 tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
References
Link Providers
https://blog.gitguardian.com/compromised-tj-actions/ cve-icon cve-icon
https://github.com/chains-project/maven-lockfile/pull/1111 cve-icon cve-icon
https://github.com/espressif/arduino-esp32/issues/11127 cve-icon cve-icon
https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193 cve-icon cve-icon
https://github.com/modal-labs/modal-examples/issues/1100 cve-icon cve-icon
https://github.com/rackerlabs/genestack/pull/903 cve-icon cve-icon
https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 cve-icon cve-icon
https://github.com/tj-actions/changed-files/issues/2463 cve-icon cve-icon
https://github.com/tj-actions/changed-files/issues/2464 cve-icon cve-icon
https://github.com/tj-actions/changed-files/issues/2477 cve-icon cve-icon
https://news.ycombinator.com/item?id=43367987 cve-icon cve-icon
https://news.ycombinator.com/item?id=43368870 cve-icon cve-icon
https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/ cve-icon cve-icon
https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/ cve-icon cve-icon
https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463 cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066 cve-icon cve-icon
https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 cve-icon
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised cve-icon cve-icon
https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond cve-icon cve-icon
https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack cve-icon cve-icon
https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 cve-icon cve-icon
History
Type Values Removed Values Added
Metrics epss

{'score': 0.77584}

 epss

{'score': 0.78859}
Type Values Removed Values Added
First Time appeared Tj-actions
Tj-actions changed-files
Weaknesses NVD-CWE-Other
CPEs cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*
Vendors & Products Tj-actions
Tj-actions changed-files
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-03-18'}
Type Values Removed Values Added
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Type Values Removed Values Added
Description tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were not originally affected, but were modified by a threat actor to point at commit 0e58ed8, which contains the malicious updateFeatures code.) tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Type Values Removed Values Added
References
Type Values Removed Values Added
Weaknesses CWE-506
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}
Type Values Removed Values Added
Description tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were not originally affected, but were modified by a threat actor to point at commit 0e58ed8, which contains the malicious updateFeatures code.)
References
Earlier changes (15)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Feb 26, 2026, 7:09 PM
Reserved
Mar 15, 2025, 12:00 AM

View source JSON

Updated
Mar 18, 2025, 9:05 PM

JSON

Status
Analyzed
Published
Mar 15, 2025, 6:15 AM
Modified
Sep 24, 2026, 1:10 PM

View source JSON

No data.

No data.