CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code
Attackers can steal secrets and execute code via maliciously modified GitHub Actions tags in tj-actions changed-files.
- Exploited in the wild
- Since 18 Mar 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30066?
CVE-2025-30066 is a high-severity vulnerability in tj-actions changed-files, published on 15 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Weakness: CWE-506
Which versions are affected by CVE-2025-30066?
1 open source package ship an affected version, including tj-actions/changed-files. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tj-actions/changed-files GitHub Actions | All versions | 46.0.1 |
Products include Tj-Actions Changed-Files.
How do I fix CVE-2025-30066?
Upgrade tj-actions/changed-files to 46.0.1 or later. US federal agencies must fix it by 8 Apr 2025.
Is CVE-2025-30066 being exploited?
Yes. Attackers have exploited CVE-2025-30066 in the wild since at least 18 Mar 2025.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in tj-actions changed-files
Sources
Also known as GHSA-mrrh-fwg8-r2c3.