reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

8.6 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitation Likelihood

EPSS Prediction

15.39 %

Predictive Probability

Percentile Rank

94.5 th

Documented as more likely to be exploited than 94.5% of known CVEs.

Detection Date

Mar 24, 2025

Remediation Due

Apr 14, 2025

CISA Catalog Active

Threat Analysis

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

Remediation Directive

Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Asset Context

Vendor Identity

reviewdog

Affected Product

action-setup GitHub Action

Ransomware Status

Campaign Use Unknown

Weakness Classification

CWE-506

External Intelligence

CISA

CISA Advisory

https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction

Additional References:

https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-30154