Actively exploited · Published Mar 15, 2025 · Assigned by mitre
CVE-2025-30066
High 8.6 Exploited
In plain English
A high-severity security flaw in changed-files from tj-actions. Attackers are actively exploiting it in the wild (listed by CISA on March 18, 2025). The chance it is exploited in the next 30 days is estimated at 72.1% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Apr 8, 2025.
Official description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tj-actions | changed-files | 1 – before 46 |
Weakness: CWE-506 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
- https://github.com/tj-actions/changed-files/issues/2463
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
- https://news.ycombinator.com/item?id=43368870
- https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463
- https://news.ycombinator.com/item?id=43367987
- https://github.com/rackerlabs/genestack/pull/903
- https://github.com/chains-project/maven-lockfile/pull/1111
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/
- https://github.com/espressif/arduino-esp32/issues/11127
- https://github.com/modal-labs/modal-examples/issues/1100
- https://github.com/tj-actions/changed-files/issues/2464
- https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
- https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
- https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond
- https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack
- https://github.com/tj-actions/changed-files/issues/2477
- https://blog.gitguardian.com/compromised-tj-actions/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066 government-resource
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066