tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

8.6 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitation Likelihood

EPSS Prediction

90.35 %

Predictive Probability

Percentile Rank

99.6 th

Documented as more likely to be exploited than 99.6% of known CVEs.

Detection Date

Mar 18, 2025

Remediation Due

Apr 08, 2025

CISA Catalog Active

Threat Analysis

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

Remediation Directive

Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Asset Context

Vendor Identity

tj-actions

Affected Product

changed-files GitHub Action

Ransomware Status

Campaign Use Unknown

Weakness Classification

CWE-506

External Intelligence

CISA

CISA Advisory

https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction

Additional References:

https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-30066