Risk Letters

Exploited vulnerability

CVE-2025-30066

TLP:CLEAR

tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

Facts

  • Vendor: tj-actions
  • Product: changed-files GitHub Action
  • CVSS: 8.6
  • EPSS (probability of exploitation within 30 days): 72.1 %
  • On CISA's Known Exploited Vulnerabilities list since: 18 March 2025
  • First known exploitation: 18 March 2025
  • CISA's deadline for US federal agencies: 8 April 2025
  • Weakness: CWE-506
  • First seen by Risk Letters: 18 March 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD