GitHub Actions reviewdog/action-setup Supply Chain Compromise and Secrets Leak (CVE-2025-30154)
Executive & SecOps Summary
SECOPS ASSESSMENTWorkflows executing reviewdog/action-setup@v1 and dependent actions between March 11, 2025, 18:42 and 20:31 UTC
Malicious code injected into the action dumps exposed secrets to GitHub Actions Workflow Logs, leading to potential credential theft
Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update your workflow files to reference the secure, patched commit SHA instead of the mutable @v1 tag.
# Example modification in .github/workflows/ci.yml
steps:
- name: Setup reviewdog
# Pin to the secure patched commit hash instead of @v1
uses: reviewdog/action-setup@3f401fe1d58fe77e10d665ab713057375e39b8872. Temporary Workaround & Hardening Configuration
Immediately revoke and rotate any secrets that were accessible to the runner during the compromised timeframe. Use the GitHub CLI to identify and remove potentially compromised secrets.
# List secrets in the target repository
gh secret list --repo 'your-org/your-repo'
# Delete compromised secrets to prevent unauthorized access
gh secret delete AWS_SECRET_ACCESS_KEY --repo 'your-org/your-repo'3. Log Audit & IoC Verification Commands
Scan your repositories for references to the compromised action and audit workflow runs executed during the incident window.
# Search for reviewdog/action-setup usage in your workflows
grep -rn 'reviewdog/action-setup' .github/workflows/
# List workflow runs executed on the day of the compromise for auditing
gh run list --created '2025-03-11' --limit 100Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-30154) is a critical software supply chain compromise targeting the widely used reviewdog/action-setup GitHub Action. Between 18:42 and 20:31 UTC on March 11, 2025, an unauthorized actor compromised the repository and modified the code associated with the reviewdog/action-setup@v1 tag. This malicious code insertion (CWE-506) allowed arbitrary code execution within the context of runner environments executing the compromised action.
2. Exploitation Mechanics & Attack Scenario
During the active compromise window, any workflow run that pulled reviewdog/action-setup@v1 executed the injected malicious payload. The payload was designed to harvest sensitive environment variables and GitHub context secrets, subsequently dumping them directly into the GitHub Actions Workflow Logs or exfiltrating them. Because other reviewdog actions (such as action-shellcheck, action-staticcheck, etc.) internally rely on reviewdog/action-setup@v1, they were also transitively compromised regardless of their individual version pinning.
3. Infrastructure & Business Impact
Given its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat of active exploitation. Exposed secrets (such as cloud provider credentials, API tokens, and deployment keys) allow attackers to gain unauthorized access to production environments, source code repositories, and internal databases. This can lead to secondary infrastructure compromise, data breaches, and potential ransomware deployment.
Official Vendor Advisories & References
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Frequently Asked SecOps Questions (CVE-2025-30154)
FAQQ1. How critical is CVE-2025-30154 and is it actively exploited in the wild?
CVE-2025-30154 is rated CVSS 8.6 (HIGH) with a 30-day EPSS exploitation probability of 2.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-30154?
Primary impacted vendors include reviewdog across action-setup, action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos. Scope summary: reviewdog/action-setup@v1 and dependent reviewdog actions executed between March 11, 2025, 18:42 and 20:31 UTC
Q3. What temporary mitigations or workarounds exist for CVE-2025-30154 before patching?
[Mitigation] Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-30154
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (reviewdog)
View Category →Nx Console VS Code Extension Supply Chain Compromise and Malicious Code Injection (CVE-2026-48027)
[Affected Scope] Nx Console extension version 18.95.0 distributed via VS Code Marketplace and OpenVSX
TanStack npm Packages Supply Chain Compromise via GitHub Actions OIDC Exploitation (CVE-2026-45321)
[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.