CVSS 3.1
8.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVE-2025-30066
High (8.6) in tj-actions changed-files GitHub Action. In CISA KEV since 2025-03-18. EPSS 72% chance of exploitation in the next 30 days.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Severity
- EPSS
- 72% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-03-18, due 2025-04-08
- CWE
- CWE-506
- Published
- Modified
- Record from
- the NVD, synced
Affected
- tj-actions:changed-files
References
- https://blog.gitguardian.com/compromised-tj-actions/
- https://github.com/chains-project/maven-lockfile/pull/1111
- https://github.com/espressif/arduino-esp32/issues/11127
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
- https://github.com/modal-labs/modal-examples/issues/1100