High, CVSS 8.6Exploited · CISA KEVGitHub ActionsPublished
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
CVE-2025-30066 · GHSA-mrrh-fwg8-r2c3
- Affected
- GitHub Actions tj-actions/changed-files <= 45.0.7
- Fixed in
- 46.0.1· Vendor fix available
- Issue
- A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and March 15, 2025, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information. This has been patched in v46.0.1. Details The attack involved modifying the tj-actions/changed-files GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs. Key Indicators of Compromise (IoC): - Malicious commit: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - Retroactively updated tags pointing to the malicious commit: - v1.0.0: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - v35.7.7-sec:…
Recommended action: Upgrade to 46.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.