CVE-2025-30066
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 8 April 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
- CVSS 3.1
- 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS
- 72.09% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 18 March 2025 · due 8 April 2025
- Weakness
- CWE-506
- Affected
- tj-actions/changed-files
- Source
- cve@mitre.org
EPSS moved from 72.1% on 24 September 2026 to 72.1% on 30 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction ; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 ; https://nvd.nist.gov/vuln/detail/CVE-2025-30066
References
- https://blog.gitguardian.com/compromised-tj-actions/Exploit, Third Party Advisory
- https://github.com/chains-project/maven-lockfile/pull/1111Issue Tracking
- https://github.com/espressif/arduino-esp32/issues/11127Issue Tracking
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193Product
- https://github.com/modal-labs/modal-examples/issues/1100Issue Tracking
- https://github.com/rackerlabs/genestack/pull/903Issue Tracking
- https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28Product
- https://github.com/tj-actions/changed-files/issues/2463Issue Tracking
- https://github.com/tj-actions/changed-files/issues/2464Issue Tracking
- https://github.com/tj-actions/changed-files/issues/2477Issue Tracking
- https://news.ycombinator.com/item?id=43367987Issue Tracking, Third Party Advisory
- https://news.ycombinator.com/item?id=43368870Issue Tracking, Third Party Advisory
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/Third Party Advisory
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/Mitigation, Third Party Advisory
- https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463Issue Tracking
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromisedExploit, Mitigation, Third Party Advisory
- https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respondThird Party Advisory
- https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attackThird Party Advisory
- https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066Third Party Advisory
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066Third Party Advisory, US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.