Multiple Reviewdog actions were compromised during a specific time period
Workflows that used reviewdog/action-setup@v1 between March 11, 2025, 18:42 and 20:31 UTC were exposed, and other reviewdog actions that use that setup action were also affected. No fix is recorded.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The reviewdog/action-setup GitHub Action and several other reviewdog GitHub Actions that depend on it (including action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, and action-typos) were affected. Malicious code in the affected setup action could expose secrets by writing them to GitHub Actions workflow logs, regardless of how the actions were pinned.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- reviewdog reviewdog
1
References 5
GitHub · reviewdog/reviewdog
GitHub · reviewdog/action-setup
Questions about CVE-2025-30154
What does this mean?
Malicious code was added to reviewdog/action-setup@v1 that dumps exposed secrets into GitHub Actions workflow logs.Source: github.com
Am I affected, and how do I check?
Workflows that used reviewdog/action-setup@v1 while it was compromised, March 11, 2025, 18:42 to 20:31 UTC. Other reviewdog actions that use reviewdog/action-setup@v1 are also affected, regardless of their version or pinning method. To check, look for reviewdog/action-setup@v1 in workflow runs from that time window.Source: github.com
What should I do about it?
No fixed version is named in the available information. Review GitHub Actions workflow logs from the compromise window for exposed secrets.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-03-24, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The available information does not describe a workaround or a fix. Avoid using reviewdog/action-setup@v1 in workflows until the vendor confirms a fixed release.Source: github.com