CVE-2025-30066

{"id": "CVE-2025-30066", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2025-03-15T06:15:12.193", "references": [{"url": "https://blog.gitguardian.com/compromised-tj-actions/", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/chains-project/maven-lockfile/pull/1111", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/espressif/arduino-esp32/issues/11127", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://github.com/modal-labs/modal-examples/issues/1100", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/rackerlabs/genestack/pull/903", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://github.com/tj-actions/changed-files/issues/2463", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/tj-actions/changed-files/issues/2464", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/tj-actions/changed-files/issues/2477", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://news.ycombinator.com/item?id=43367987", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://news.ycombinator.com/item?id=43368870", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/", "tags": ["Mitigation", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066", "tags": ["US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-506"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)"}, {"lang": "es", "value": "Los archivos modificados de tj-actions anteriores a la versi\u00f3n 46 permiten a atacantes remotos descubrir secretos leyendo los registros de acciones. (Las etiquetas v1 a v45.0.7 se vieron afectadas el 14 y el 15 de marzo de 2025 porque fueron modificadas por un actor de amenazas para apuntar a el commit 0e58ed8, que conten\u00eda c\u00f3digo malicioso de updateFeatures)."}], "lastModified": "2025-11-05T19:27:53.740", "cisaActionDue": "2025-04-08", "cisaExploitAdd": "2025-03-18", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23B2BE4B-AC69-4088-9ABD-ACDB46ABAA9A", "versionEndIncluding": "45.0.7"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]", "cisaRequiredAction": "Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability"}