CVE-2025-30154: high-severity vulnerability in reviewdog
Multiple Reviewdog actions were compromised during a specific time period
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A GitHub action used to install reviewdog was compromised for about 2 hours on March 11, 2025, and injected malicious code that exposed sensitive secrets in workflow logs. This affected multiple related actions and any workflow using them during that time period.
reviewdog/action-setup@v1 was compromised (2025-03-11, 18:42–20:31 UTC) and contained malicious code exfiltrating GitHub Actions secrets to workflow logs. The vulnerability affects downstream actions (action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos) regardless of version pinning. Attack vector is supply-chain; impact includes exposure of repository secrets, tokens, and credentials in publicly accessible logs.
The full analysis of this CVE is available in Portuguese →