Log in Start free

Actively exploited · Published Mar 19, 2025 · Assigned by GitHub_M

CVE-2025-30154Multiple Reviewdog actions were compromised during a specific time period

High 8.6 Exploited

In plain English

A high-severity security flaw in reviewdog from reviewdog. Attackers are actively exploiting it in the wild (listed by CISA on March 24, 2025). The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)2.5%top 15.3% of all CVEs
Exploited in the wildYesCISA KEV since Mar 24, 2025
Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Apr 14, 2025.

Official description

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

Affected products (as reported)

VendorProductVersions
reviewdog reviewdog = 1

Weakness: CWE-506 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References