CVE-2025-30154 reviewdog/action-setup GitHub Action Embedded Malicious Code
Compromised GitHub Actions injected malicious code to leak secrets into workflow logs, requiring users to update to clean versions.
- Exploited in the wild
- Since 24 Mar 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30154?
CVE-2025-30154 is a high-severity vulnerability in reviewdog, published on 19 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Weakness: CWE-506
Which versions are affected by CVE-2025-30154?
1 open source package ship an affected version, including reviewdog/action-setup. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
reviewdog/action-setup GitHub Actions | All versions | None |
Products include Reviewdog Action-Ast-Grep, Reviewdog Action-Composite-Template, Reviewdog Action-Setup, Reviewdog Action-Shellcheck, Reviewdog Action-Staticcheck, Reviewdog Action-Typos.
How do I fix CVE-2025-30154?
No fix has been published for CVE-2025-30154 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Apr 2025.
Is CVE-2025-30154 being exploited?
Yes. Attackers have exploited CVE-2025-30154 in the wild since at least 24 Mar 2025.
Sources
Also known as GHSA-qmg3-hpqr-gqvc.