tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.
Affects tj-actions changed-files before 46 in workflows with publicly readable logs that use a tag pointing to malicious commit 0e58ed8, on Linux runners. Fixed in 46.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 46
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The tj-actions/changed-files GitHub Action, used in CI/CD workflows, is affected. A remote attacker could discover secrets, such as access tokens and credentials, by reading the workflow logs.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- tj-actions changed-files
From 1 · fixed in 46
References 19
GitHub · github/docs
GitHub · tj-actions/changed-files
news.ycombinator.com
GitHub · rackerlabs/genestack
GitHub · chains-project/maven-lockfile
sysdig.com
GitHub · espressif/arduino-esp32
GitHub · modal-labs/modal-examples
stream.security
sweet.security
blog.gitguardian.com
Questions about CVE-2025-30066
What does this mean?
The compromised Action prints CI/CD secrets into GitHub Actions build logs. Anyone who can read those logs can obtain the secrets that were printed.Source: stepsecurity.io
Am I affected, and how do I check?
Versions of tj-actions changed-files before 46 are affected. The exposure also requires workflow logs that are publicly accessible, such as in public repositories, a version tag that was updated to point to commit 0e58ed8, and a Linux runner. Check the version tag pinned in the workflow files and whether the repository's logs are public.Source: stepsecurity.io
What should I do about it?
Upgrade to version 46 or later. As an alternative, replace tj-actions/changed-files with the StepSecurity secure alternative step-security/changed-files.Source: stepsecurity.io
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-03-18, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data