Supply-chain attacksBriefPublic record
tj-actions/changed-files tag hijack (CVE-2025-30066) via reviewdog/action-setup (CVE-2025-30154)
14 to 15 Mar 2025. All tags were repointed to a commit that dumped runner memory secrets into public logs.
- Disclosed
What happened
- Scale: 23,000+ repos used the action. The initial target was Coinbase (Unit 42). Root cause: a compromised reviewdog bot PAT.
- Fixed: v46.0.1. KEV: 18 Mar 2025 (-30066) and 24 Mar 2025 (-30154).
Live scores
Live scores
CVE-2025-30066- EPSS
- 0.721
very likely to be attacked soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Yes, since 2025-03-18
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-30154- EPSS
- 0.025
some chance of attack soon - VEDAS
- 0.971
strong exploit evidence - On CISA KEV
- Yes, since 2025-03-24
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction
- https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.