CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-03-15
tj-actions changed-files GitHub Action Supply Chain Compromise and Malicious Code Injection (CVE-2025-30066)
[Affected Scope] GitHub Actions workflows utilizing tj-actions/changed-files action versions v1 through v45.0.7
[Impact] Threat actors modified release tags to point to a malicious commit (0e58ed8), enabling execution of malicious code ('updateFeatures') and exfiltration of GitHub Secrets via action logs
[Mitigation] Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA