Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2025-30066: tj-actions/changed-files action can expose secrets in logs
CVE-2025-30066 · published 1 year ago · actively exploited
Summary
The tj-actions/changed-files GitHub Action versions before 46 were altered to include hidden code that lets attackers read the workflow logs and discover confidential information. This means private keys, passwords, or other secrets stored in the logs could be exposed. Update to version 46 or later and review any logs that may have been accessed for potential leaks.
What to do
- Update tj-actions changed-files to version 46.0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | tj-actions | changed-files github action | All versions |
| actions | tj-actions | changed-files |
<= 45.0.7 Fix: upgrade to 46.0.1
|
Original advisory text
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
References
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-su...
- https://github.com/tj-actions/changed-files/releases/tag/v46.0.1
- https://blog.gitguardian.com/compromised-tj-actions
- https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x...
- https://github.com/advisories/GHSA-mrrh-fwg8-r2c3
- https://nvd.nist.gov/vuln/detail/CVE-2025-30066 Vendor Advisory
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-c...
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/con... URL
- https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c... URL
- https://news.ycombinator.com/item?id=43367987 URL
- https://github.com/tj-actions/changed-files/issues/2477 Third Party Advisory
- https://news.ycombinator.com/item?id=43368870 URL
- https://github.com/espressif/arduino-esp32/issues/11127 Third Party Advisory
- https://github.com/modal-labs/modal-examples/issues/1100 Third Party Advisory
- https://github.com/tj-actions/changed-files/issues/2463 Third Party Advisory
- https://github.com/chains-project/maven-lockfile/pull/1111 Patch
- https://github.com/rackerlabs/genestack/pull/903 Patch
- https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed... URL
- https://github.com/tj-actions/changed-files/issues/2464 Third Party Advisory
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-c... Third Party Advisory
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-su... Third Party Advisory
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-file... Third Party Advisory
- https://www.stream.security/post/github-action-supply-chain-attack-exposes-secre... URL
- https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30066... Vendor Advisory
- https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-atta... Third Party Advisory
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third... URL
- https://blog.gitguardian.com/compromised-tj-actions/ Third Party Advisory
Internet-facing
3 days
Internal
14 days
- Known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.6
High
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
72%
chance of attack within 30 days
Type
CWE-506Embedded Malicious Code
Timeline
Published15 Mar 2025
Updated21 Oct 2026
First seen6 Mar 2026
Sources
CVE-2025-30066 · CISA KEV
CVE-2025-30066 · NVD
GHSA-mrrh-fwg8-r2c3 · GHSA
CVE-2025-30066 · OSV
Track software like this
Free during beta