AEGLIX vulnerability intelligence
CVE-2025-30066
HIGH · CVSS 8.6 · Analyzed
Published: 2025-03-15 · Updated: 2026-09-24 · Source: NVD
Vulnerability overview
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Severity and scoring
- CVSS score
- 8.6 · HIGH
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-506, NVD-CWE-Other
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- tj-actions · changed-files GitHub Action
- Added to catalog
- 2025-03-18
- Required action
- Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA remediation due date
- 2025-04-08
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*
Through (inclusive): 45.0.7
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://blog.gitguardian.com/compromised-tj-actions/
Exploit · Third Party Advisory
- https://github.com/chains-project/maven-lockfile/pull/1111
Issue Tracking
- https://github.com/espressif/arduino-esp32/issues/11127
Issue Tracking
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
Product
- https://github.com/modal-labs/modal-examples/issues/1100
Issue Tracking
- https://github.com/rackerlabs/genestack/pull/903
Issue Tracking
- https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
Product
- https://github.com/tj-actions/changed-files/issues/2463
Issue Tracking
- https://github.com/tj-actions/changed-files/issues/2464
Issue Tracking
- https://github.com/tj-actions/changed-files/issues/2477
Issue Tracking
- https://news.ycombinator.com/item?id=43367987
Issue Tracking · Third Party Advisory
- https://news.ycombinator.com/item?id=43368870
Issue Tracking · Third Party Advisory
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
Third Party Advisory
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/
Mitigation · Third Party Advisory
- https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463
Issue Tracking
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
Exploit · Mitigation · Third Party Advisory
- https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond
Third Party Advisory
- https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack
Third Party Advisory
- https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
Third Party Advisory
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066
Third Party Advisory · US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066
US Government Resource