Dashboard / CVE-2025-30066

CVE-2025-30066

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 10/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

CISA Known Exploited Vulnerability

Vendor / Product tj-actions — changed-files GitHub Action
Date Added 2025-03-18
Remediation Due 2025-04-08
This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction ; Additional References: https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 ; https://nvd.nist.gov/vuln/detail/CVE-2025-30066

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
tj-actions changed-files < 45.0.7

References & Advisories (21)

https://news.ycombinator.com/item?id=43367987
Issue Tracking Third Party Advisory
https://news.ycombinator.com/item?id=43368870
Issue Tracking Third Party Advisory

Bug Bounty Relevance

10 / 100
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

Unscored

EPSS — Exploitation Probability

72.09%
Raw Score 0.720920
Percentile 99.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.72092
2026-10-28
0.72092

Intelligence Sources

kev ref →

External Links