CISA Adds New GitHub Action Vulnerability to Known Exploited Vulnerabilities Catalog: A Growing Threat to Supply Chain Security

On March 18, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a significant vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, which is linked to the recent compromise of the GitHub Action tj-actions/changed-files. This vulnerability, tracked as CVE-2025-30066, poses a high-severity threat, with a CVSS score of 8.6, and has raised alarms regarding the security of software supply chains and remote code injection attacks.

the Vulnerability

The vulnerability found in tj-actions/changed-files GitHub Action allows attackers to inject malicious code that grants them access to sensitive data through action logs. These logs can reveal critical secrets such as AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys. This type of attack emphasizes a growing trend of vulnerabilities in popular CI/CD tools, which are increasingly becoming targets for attackers.

The attack appears to be part of a larger, cascading supply chain assault. Cloud security company Wiz has reported that the attackers initially compromised the reviewdog/action-setup@v1 GitHub Action, which is used in tj-actions/changed-files. This series of compromises ultimately allowed attackers to execute remote code and expose repository secrets.

The breach of tj-actions/changed-files was discovered around March 14, 2025, but the root compromise of the reviewdog action occurred earlier, likely on March 11, 2025. The attackers exploited a GitHub Personal Access Token (PAT), which gave them unauthorized access to modify the repository’s content, particularly the v1 tag of the GitHub Action.

The malicious code was inserted into CI/CD workflows through a Base64-encoded payload within a script file (install.sh), which is then executed within the workflow. This payload collects and exposes sensitive secrets, further amplifying the risk to organizations relying on these actions in their development pipelines.

What Undercode Says:

This attack raises significant concerns about the security of software supply chains, particularly the reliance on third-party GitHub Actions in continuous integration and delivery workflows. Supply chain compromises have been a growing issue over the past few years, with attackers increasingly targeting the dependencies and tools that developers rely on.

What makes this attack especially worrisome is the cascading nature of the breach. By compromising one popular GitHub Action (reviewdog/action-setup@v1), attackers were able to gain access to other tools that depend on it, such as tj-actions/changed-files. This is a key reminder that the security of the tools you depend on can have a direct impact on the security of your entire development process.

The

Moreover, the fact that the attack was only discovered after it had already been ongoing for a few days shows the importance of continuous monitoring and rapid detection of unusual activities in workflows. Organizations must adopt a proactive approach to securing their CI/CD environments, which includes regularly auditing logs, using multi-factor authentication, and avoiding the use of generic or overly permissive access tokens.

The cascading nature of this breach suggests a deeper issue with trust and dependency within the open-source community. With contributors constantly joining and leaving GitHub projects, the attack surface for malicious activity increases. In this case, it’s possible that the attackers gained access to the compromised reviewdog action through automated contributor invites, further exposing the vulnerabilities of open-source repositories.

Moving forward, it is critical that organizations apply the necessary patches and take extra precautions to minimize the impact of such attacks. This includes pinning GitHub Actions to specific commit hashes instead of relying on version tags, which can be updated by malicious actors to deliver compromised code. Additionally, affected organizations are advised to rotate any secrets that may have been exposed and audit their past workflows for suspicious activity.

Fact Checker Results:

Malicious Code Injection: The vulnerability was indeed introduced through the tj-actions/changed-files GitHub Action, which was compromised via an attack on reviewdog/action-setup@v1.
Sensitive Data Exposure: The flaw exposed sensitive data such as AWS keys and GitHub PATs, confirming the severity of the risk.
Mitigation Steps: Affected users are advised to update to the latest version (46.0.1) of the tj-actions/changed-files action and rotate any exposed secrets, highlighting the immediate response required to address the vulnerability.

References:

Reported By: https://thehackernews.com/2025/03/cisa-warns-of-active-exploitation-in.html
Extra Source Hub:
https://www.quora.com/topic/Technology
Wikipedia
Undercode AI