CVE-2025-30066

What it actually does

The vulnerability is a supply-chain compromise of the tj-actions/changed-files GitHub Action. A threat actor modified affected release tags v1 through v45.0.7 on 2025-03-14 and 2025-03-15 so that workflows referencing those tags resolved to malicious commit 0e58ed8. The malicious updateFeatures code executed inside GitHub Actions runners and caused secrets available to the workflow environment to be exposed through workflow logs. The primary technical impact is unauthorized disclosure of CI/CD secrets such as repository secrets, cloud credentials, package publishing tokens, deployment keys, API tokens, and other environment variables accessible to the compromised workflow run. Because GitHub Actions often runs with repository write tokens and deployment credentials, stolen secrets can enable follow-on source-code tampering, package publication, cloud access, and lateral movement across build and deployment systems.

Why it matters to the business

Organizations that used affected tj-actions/changed-files versions may have had sensitive CI/CD credentials exposed in build logs. This can lead to unauthorized access to source code, cloud accounts, artifact registries, production deployment pipelines, and third-party services. The issue is confirmed as actively exploited in the wild, has a high EPSS score, and is listed in CISA KEV with a remediation deadline of 2025-04-08, so any remaining exposure should be treated as urgent and any historical use during the compromise window should trigger credential-rotation and incident-response activity. There is no current KEV ransomware attribution, but the stolen secrets could be used by opportunistic or targeted actors for later compromise.

How an attack unfolds

An attacker compromises the upstream GitHub Action supply chain by moving trusted version tags for tj-actions/changed-files to a malicious commit. Downstream repositories that pin workflows to affected tags such as tj-actions/changed-files@v1 through @v45.0.7 automatically fetch and execute the malicious action during CI/CD workflow runs. The malicious updateFeatures code executes with the privileges and environment of the GitHub Actions runner, where repository secrets, workflow tokens, deployment credentials, and service tokens may be present. It then causes secrets to be written or recoverable from workflow logs. An attacker who can view public logs, compromised private logs, or otherwise retrieve workflow artifacts can collect those secrets and use them for follow-on access to repositories, cloud resources, package registries, or deployment targets.

How to fix it

Immediately stop using affected mutable tags of tj-actions/changed-files v1 through v45.0.7. Upgrade to tj-actions/changed-files v46 or later, or pin the action to a known-good immutable commit SHA rather than a mutable tag. Review all workflows for references to tj-actions/changed-files@v1 through @v45.0.7 and replace them. Treat any secrets available to affected workflow runs during 2025-03-14 and 2025-03-15 as potentially compromised and rotate them, including GitHub tokens, cloud keys, package registry tokens, deployment credentials, SSH keys, webhook secrets, and API keys. Invalidate or reduce permissions for long-lived credentials, prefer short-lived OIDC-based federation for cloud access, and enforce least-privilege permissions in workflow files using the permissions block. Restrict GitHub Actions log visibility where possible and delete or restrict access to logs that may contain exposed secrets after preserving evidence needed for incident response. If this vulnerability is being tracked through Ubuntu package metadata for linux-raspi-5.4 on Ubuntu Pro 18.04 LTS, update to linux-raspi-5.4 version 5.4.0-1114.126~18.04.1 or later; however, the core exposure described here is the compromised GitHub Action and should be remediated in CI/CD workflows.

How to confirm the fix worked

Confirm that no workflow files reference tj-actions/changed-files@v1 through tj-actions/changed-files@v45.0.7. Search all repositories and workflow templates for uses of tj-actions/changed-files and verify they use v46 or later, or a vetted immutable commit SHA. Review GitHub Actions workflow run history for executions on 2025-03-14 and 2025-03-15 that included tj-actions/changed-files. Confirm all secrets available to those runs have been rotated after the last potentially affected execution. Validate that repository Actions settings enforce least-privilege GITHUB_TOKEN permissions and that cloud deployments use short-lived OIDC credentials where feasible. For systems tracking the Ubuntu linux-raspi-5.4 package, verify the installed package version is 5.4.0-1114.126~18.04.1 or newer. Finally, run a controlled workflow to ensure the updated action behaves normally and that logs do not contain secret-like values.

Typical attack path

1. Identify repositories or organizations using tj-actions/changed-files with mutable affected tags v1 through v45.0.7.
2. Wait for or trigger a GitHub Actions workflow that invokes the compromised action during the 2025-03-14 to 2025-03-15 compromise window.
3. The workflow runner downloads and executes the malicious code from commit 0e58ed8.
4. The malicious updateFeatures logic accesses or causes disclosure of secrets available to the workflow environment.
5. Secrets are exposed through GitHub Actions logs or related workflow output.
6. The attacker retrieves exposed credentials from logs or artifacts.
7. The attacker reuses stolen credentials to access source repositories, cloud platforms, artifact registries, deployment systems, or third-party APIs.
8. The attacker may establish persistence by adding new tokens, modifying workflows, publishing malicious packages, or changing deployment configuration.

How to detect it

Investigate historical GitHub Actions activity for workflow runs on 2025-03-14 and 2025-03-15 that used tj-actions/changed-files versions v1 through v45.0.7 or resolved to commit 0e58ed8. Primary log sources are GitHub Actions workflow logs, workflow run metadata, repository audit logs, organization audit logs, secret access and rotation records, cloud provider audit logs, artifact/package registry logs, and source-control events after affected runs. Search workflow logs for references to tj-actions/changed-files, the malicious commit, updateFeatures, unexpected encoded or dumped environment content, and unusually large log sections emitted by the changed-files step. Correlate any exposed or potentially exposed credentials with downstream use: cloud API calls, package publishing, Git pushes, release creation, Actions workflow edits, new deploy keys, new personal access tokens, modified branch protections, new webhooks, or unexpected service-account activity after the affected run time. For public repositories, assume logs may have been scraped by third parties. For private repositories, review who accessed workflow logs and artifacts during and after the compromise window. Lack of visible secrets in logs is not sufficient to rule out exposure; rotate secrets that were available to affected workflows regardless of whether they are plainly recoverable.

• tj-actions/changed-files
• tj-actions/changed-files@v1
• tj-actions/changed-files@v2
• tj-actions/changed-files@v3
• tj-actions/changed-files@v4
• tj-actions/changed-files@v5
• tj-actions/changed-files@v6
• tj-actions/changed-files@v7
• tj-actions/changed-files@v8
• tj-actions/changed-files@v9
• tj-actions/changed-files@v10
• tj-actions/changed-files@v11
• tj-actions/changed-files@v12
• tj-actions/changed-files@v13
• tj-actions/changed-files@v14
• tj-actions/changed-files@v15
• tj-actions/changed-files@v16
• tj-actions/changed-files@v17
• tj-actions/changed-files@v18
• tj-actions/changed-files@v19
• tj-actions/changed-files@v20
• tj-actions/changed-files@v21
• tj-actions/changed-files@v22
• tj-actions/changed-files@v23
• tj-actions/changed-files@v24
• tj-actions/changed-files@v25
• tj-actions/changed-files@v26
• tj-actions/changed-files@v27
• tj-actions/changed-files@v28
• tj-actions/changed-files@v29
• tj-actions/changed-files@v30
• tj-actions/changed-files@v31
• tj-actions/changed-files@v32
• tj-actions/changed-files@v33
• tj-actions/changed-files@v34
• tj-actions/changed-files@v35
• tj-actions/changed-files@v36
• tj-actions/changed-files@v37
• tj-actions/changed-files@v38
• tj-actions/changed-files@v39
• tj-actions/changed-files@v40
• tj-actions/changed-files@v41
• tj-actions/changed-files@v42
• tj-actions/changed-files@v43
• tj-actions/changed-files@v44
• tj-actions/changed-files@v45
• tj-actions/changed-files@v45.0.7
• 0e58ed8
• updateFeatures
• uses: tj-actions/changed-files@
• changed-files@v45.0.7

What your security team should do

• Treat this as an active supply-chain credential-exposure incident, not only a patching task.
• Inventory all repositories, reusable workflows, and workflow templates using tj-actions/changed-files, prioritizing public repositories and workflows with deployment, cloud, release, or package-publishing secrets.
• Immediately update to tj-actions/changed-files v46 or later, or pin to a reviewed immutable commit SHA.
• Identify all workflow runs from 2025-03-14 through 2025-03-15 that executed affected versions and preserve relevant logs for investigation with restricted access.
• Rotate every secret exposed to affected workflow runs, including credentials that may not visibly appear in logs.
• Audit use of any rotated credentials for suspicious activity after the affected workflow execution times.
• Review repository, organization, cloud, artifact registry, and package registry audit logs for unauthorized access, token use, release creation, workflow modification, or package publication.
• Reduce blast radius by setting explicit GitHub Actions permissions, disabling unnecessary write permissions, and replacing static cloud credentials with OIDC-based short-lived access.
• Add CI policy checks to block mutable third-party action tags and require pinned SHAs or centrally approved action versions.
• Because the issue is in CISA KEV and the remediation due date has passed, escalate unresolved exposure as a high-priority risk exception.