What’s Vulnerable › Vulnerabilities

CVE-2025-30066: tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-03-18
• EPSS: 72.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-15 · updated 2026-09-24
• Weakness: CWE-506

Description

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Affected products

• tj-actions changed-files: through 45.0.7

References

• https://blog.gitguardian.com/compromised-tj-actions/
• https://github.com/chains-project/maven-lockfile/pull/1111
• https://github.com/espressif/arduino-esp32/issues/11127
• https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
• https://github.com/modal-labs/modal-examples/issues/1100
• https://github.com/rackerlabs/genestack/pull/903
• https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
• https://github.com/tj-actions/changed-files/issues/2463
• https://github.com/tj-actions/changed-files/issues/2464
• https://github.com/tj-actions/changed-files/issues/2477
• https://news.ycombinator.com/item?id=43367987
• https://news.ycombinator.com/item?id=43368870

Get alerted when CVE-2025-30066 or the next vulnerability affects your stack