CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-03-19
GitHub Actions reviewdog/action-setup Supply Chain Compromise and Secrets Leak (CVE-2025-30154)
[Affected Scope] Workflows executing reviewdog/action-setup@v1 and dependent actions between March 11, 2025, 18:42 and 20:31 UTC
[Impact] Malicious code injected into the action dumps exposed secrets to GitHub Actions Workflow Logs, leading to potential credential theft
[Mitigation] Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes