tj-actions changed-files GitHub Action Supply Chain Compromise and Malicious Code Injection (CVE-2025-30066)
Executive & SecOps Summary
SECOPS ASSESSMENTGitHub Actions workflows utilizing tj-actions/changed-files action versions v1 through v45.0.7
Threat actors modified release tags to point to a malicious commit (0e58ed8), enabling execution of malicious code ('updateFeatures') and exfiltration of GitHub Secrets via action logs
Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately update your GitHub workflow files to use version v46 or later. To prevent future tag-spoofing attacks, it is highly recommended to pin actions to an immutable commit SHA.
# BEFORE (Vulnerable Configuration)
- name: Get changed files
uses: tj-actions/changed-files@v45
# AFTER (Upgraded to Secure Version)
- name: Get changed files
uses: tj-actions/changed-files@v46
# BEST PRACTICE (Pinned to Immutable Commit SHA)
- name: Get changed files
uses: tj-actions/changed-files@d6e91a273b02df20f4c61d5b852f3024c2322744 # Example SHA for v46.0.02. Temporary Workaround & Hardening Configuration
If immediate code refactoring is not feasible, restrict the permissions of the GitHub Actions runner token to minimize the potential impact of credential exposure.
# Restrict permissions in your .github/workflows/ files
permissions:
contents: read
id-token: write3. Log Audit & IoC Verification Commands
Use the following Bash script to scan your local repositories and identify any workflows referencing the compromised versions of the action.
# Scan local repository for vulnerable tj-actions/changed-files references
echo '[*] Scanning GitHub Workflow files for vulnerable tj-actions/changed-files...'
grep -rn 'tj-actions/changed-files@v' .github/workflows/ | while read -r line; do
version=$(echo "$line" | grep -oE 'v[0-9]+(\.[0-9]+)*')
major_version=$(echo "$version" | cut -d. -f1 | tr -d 'v')
if [ "$major_version" -lt 46 ]; then
echo "[!] VULNERABLE ACTION DETECTED: $line"
fi
doneScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-30066) is a supply chain attack targeting the widely used 'tj-actions/changed-files' GitHub Action. On March 14 and 15, 2025, a threat actor compromised the release tags ranging from v1 to v45.0.7, force-pushing them to point to a malicious commit (0e58ed8). This commit contained unauthorized code named updateFeatures, causing any workflow referencing these tags to fetch and execute malicious payloads automatically.
2. Exploitation Mechanics & Attack Scenario
The attacker exploited the mutable nature of Git tags to redirect existing, trusted release versions to a malicious commit. When a target GitHub Actions workflow is triggered, the runner pulls the action based on the specified tag. Upon execution, the malicious updateFeatures script runs within the runner environment, harvesting sensitive environment variables, GitHub tokens, and repository secrets, and subsequently exposing them through the action execution logs or external exfiltration channels.
3. Infrastructure & Business Impact
With a CVSS score of 8.6 (High) and an EPSS score of 0.7209, this vulnerability poses an immediate threat and is actively cataloged in CISA's KEV. Compromised GitHub Secrets can grant attackers unauthorized access to cloud infrastructure (AWS, Azure, GCP), package registries (NPM, PyPI), and proprietary source code repositories. This can lead to secondary supply chain attacks, lateral movement, and severe data breaches across enterprise environments.
Official Vendor Advisories & References
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Frequently Asked SecOps Questions (CVE-2025-30066)
FAQQ1. How critical is CVE-2025-30066 and is it actively exploited in the wild?
CVE-2025-30066 is rated CVSS 8.6 (HIGH) with a 30-day EPSS exploitation probability of 72.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-30066?
Primary impacted vendors include tj-actions across changed-files. Scope summary: tj-actions/changed-files GitHub Action versions v1 through v45.0.7 (compromised on March 14-15, 2025)
Q3. What temporary mitigations or workarounds exist for CVE-2025-30066 before patching?
[Mitigation] Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-30066
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (tj-actions)
View Category →Nx Console VS Code Extension Supply Chain Compromise and Malicious Code Injection (CVE-2026-48027)
[Affected Scope] Nx Console extension version 18.95.0 distributed via VS Code Marketplace and OpenVSX
TanStack npm Packages Supply Chain Compromise via GitHub Actions OIDC Exploitation (CVE-2026-45321)
[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.