CVE-2025-30066: high-severity vulnerability in tj-actions changed-files
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A GitHub action tool had a vulnerability where attackers could read secret information from action logs. The tool's older versions were compromised to include malicious code that exposed sensitive data.
CWE-506 (embedded malicious code) in tj-actions changed-files versions ≤45.0.7 allows remote attackers to exfiltrate secrets via action workflow logs; the vulnerability resulted from tag tampering that redirected to a malicious commit containing unauthorized updateFeatures functionality, affecting users who referenced the affected version tags between March 14-15, 2025.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.