CVE-2025-30154

What it actually does

CVE-2025-30154 is a CI/CD supply-chain compromise of reviewdog/action-setup@v1. During the compromise window on March 11, 2025 from 18:42 to 20:31 UTC, malicious code was introduced into the GitHub Action that caused exposed GitHub Actions secrets and environment data to be written into workflow logs. Any workflow that invoked reviewdog/action-setup@v1 during that period could have disclosed repository, organization, cloud, package-registry, deployment, or signing credentials available to the job. Related reviewdog actions that depended on reviewdog/action-setup@v1 were also affected regardless of their own version or pinning method, including reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos. The Git repository version is fixed at commit f0d342d24037bb11d26b9bd8496e0808ba32e9ec. The input also lists Ubuntu python-webob fixed packages: Ubuntu 20.04 LTS fixed in 1:1.8.5-2ubuntu0.1, Ubuntu 22.04 LTS fixed in 1:1.8.6-1.1ubuntu0.1, and Ubuntu 24.04 LTS fixed in 1:1.8.7-1ubuntu0.1.24.04.1; validate whether those package advisories apply separately in affected systems.

Why it matters to the business

This vulnerability can turn routine CI jobs into a secret-disclosure event. Leaked tokens can allow attackers to read or modify source code, publish malicious releases, access cloud resources, tamper with build artifacts, move into package registries, or impersonate trusted automation. Because this is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2025-04-14, organizations should treat historical exposure during the compromise window as an incident-response priority, not only a patching task. Even though the EPSS score is relatively low at 0.02296, the confirmed exploitation and CI/CD credential impact make the operational risk high.

How an attack unfolds

An attacker compromised the upstream reviewdog/action-setup@v1 GitHub Action and inserted malicious behavior that executed inside consumer GitHub Actions workflows. When a repository workflow ran the affected action or a dependent reviewdog action during the March 11, 2025 18:42-20:31 UTC window, the malicious code executed with the permissions and environment of that workflow job. It attempted to expose secrets available to the workflow by printing them into GitHub Actions workflow logs. If logs were accessible to maintainers, contributors, third-party integrations, or attackers with repository access, those secrets could be collected and reused. Follow-on activity may include use of leaked GitHub tokens, cloud credentials, package publishing tokens, SSH keys, or signing keys to access source repositories, modify workflow files, push malicious commits, publish compromised packages, create backdoors, or access production and staging infrastructure.

How to fix it

Immediately stop using compromised references to reviewdog/action-setup@v1 and affected dependent reviewdog actions until verified clean. Update reviewdog/action-setup to fixed commit f0d342d24037bb11d26b9bd8496e0808ba32e9ec or a later trusted version. Review all workflows using reviewdog/action-setup, reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, or reviewdog/action-typos. Re-run only after pinning actions to trusted immutable commit SHAs and confirming the referenced commit is not within the malicious state. Rotate every secret that may have been exposed to affected workflow jobs during the compromise window, including GitHub tokens, cloud provider credentials, package registry tokens, deployment keys, webhook secrets, signing keys, and service account credentials. Delete or restrict access to impacted workflow logs after preserving required forensic copies. Minimize GitHub Actions permissions with least-privilege `permissions:` settings and prefer short-lived OIDC-based cloud credentials over long-lived static secrets. For the separately listed Ubuntu python-webob packages, apply vendor updates where applicable: Ubuntu 20.04 LTS version 1:1.8.5-2ubuntu0.1, Ubuntu 22.04 LTS version 1:1.8.6-1.1ubuntu0.1, and Ubuntu 24.04 LTS version 1:1.8.7-1ubuntu0.1.24.04.1.

How to confirm the fix worked

Inventory GitHub workflow files for use of `reviewdog/action-setup@v1` and dependent actions: `reviewdog/action-shellcheck`, `reviewdog/action-composite-template`, `reviewdog/action-staticcheck`, `reviewdog/action-ast-grep`, and `reviewdog/action-typos`. Confirm no workflow references the compromised v1 ref and that reviewdog/action-setup resolves to fixed commit f0d342d24037bb11d26b9bd8496e0808ba32e9ec or later trusted code. Check workflow run history for executions on March 11, 2025 between 18:42 and 20:31 UTC. For any matching run, assume job-scoped secrets may have been exposed and verify that those credentials were rotated. Confirm GitHub Actions logs no longer contain plaintext secrets or suspicious environment dumps. Validate repository and organization audit logs for unusual token usage, workflow changes, new deploy keys, new personal access tokens, unexpected package publishing, branch protection changes, or suspicious release activity after the compromise window. If Ubuntu python-webob exposure is in scope, verify installed package versions with package management tooling and confirm the fixed versions are installed.

Typical attack path

1. Compromise or alter the upstream reviewdog/action-setup@v1 GitHub Action code.
2. Wait for downstream repositories to run workflows that reference reviewdog/action-setup@v1 or affected dependent reviewdog actions.
3. Execute malicious code inside the GitHub Actions runner during the CI job.
4. Dump available secrets, tokens, and sensitive environment variables into GitHub Actions workflow logs.
5. Retrieve workflow logs or rely on exposed logs being accessible to unauthorized users.
6. Reuse disclosed credentials to access GitHub repositories, package registries, cloud services, deployment systems, or other connected services.
7. Modify code, releases, CI/CD workflows, packages, infrastructure, or credentials to establish persistence or expand access.

How to detect it

Review GitHub Actions workflow run history for jobs using reviewdog/action-setup@v1 or dependent reviewdog actions during March 11, 2025 18:42-20:31 UTC. Primary log sources include GitHub Actions workflow logs, GitHub repository and organization audit logs, GitHub secret scanning alerts, package registry audit logs, cloud provider audit logs, identity provider sign-in logs, and deployment platform logs. Look for workflow log output that resembles full environment dumps, shell tracing, base64-encoded blobs, access tokens, private keys, cloud credential variable names, registry tokens, or unusually verbose secret-related output. In GitHub audit logs, investigate unusual use of `GITHUB_TOKEN`, new or modified workflow files, new deploy keys, changed repository permissions, new releases, unexpected package publishes, branch protection changes, and access from unfamiliar IP addresses or automation identities after the exposure window. In cloud and registry logs, correlate activity by credentials that were available to affected workflows, especially first-time source IPs, new user agents, token use outside CI runner IP ranges, privilege changes, object storage access, container image pushes, package publishes, and deployment events. Because the malicious behavior disclosed secrets through logs, absence of malware on a runner does not prove no exposure; credential rotation and audit-log review are required for impacted jobs.

• reviewdog/action-setup@v1
• reviewdog/action-shellcheck
• reviewdog/action-composite-template
• reviewdog/action-staticcheck
• reviewdog/action-ast-grep
• reviewdog/action-typos
• f0d342d24037bb11d26b9bd8496e0808ba32e9ec
• 2025-03-11T18:42:00Z
• 2025-03-11T20:31:00Z
• ACTIONS_RUNTIME_TOKEN
• GITHUB_TOKEN
• ACTIONS_ID_TOKEN_REQUEST_TOKEN
• ACTIONS_ID_TOKEN_REQUEST_URL
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_SESSION_TOKEN
• AZURE_CLIENT_SECRET
• GOOGLE_APPLICATION_CREDENTIALS
• NPM_TOKEN
• PYPI_API_TOKEN
• DOCKER_PASSWORD
• DOCKER_USERNAME
• -----BEGIN PRIVATE KEY-----
• -----BEGIN OPENSSH PRIVATE KEY-----
• ghp_
• github_pat_
• ghs_
• ghu_

What your security team should do

• Treat any workflow execution using affected reviewdog actions during March 11, 2025 18:42-20:31 UTC as a potential credential disclosure incident.
• Immediately rotate all secrets available to affected jobs, prioritizing GitHub tokens, cloud credentials, deployment credentials, package registry tokens, and signing material.
• Search all repositories and workflow histories for `reviewdog/action-setup@v1` and the affected dependent reviewdog actions.
• Pin third-party GitHub Actions to reviewed commit SHAs instead of mutable tags, and monitor for upstream ref changes.
• Restrict default GitHub Actions token permissions and set explicit least-privilege `permissions:` blocks in workflows.
• Replace long-lived CI/CD secrets with OIDC federation and short-lived credentials wherever possible.
• Review GitHub organization, repository, cloud, and package-registry audit logs for post-compromise use of credentials that were present in affected jobs.
• Preserve affected workflow logs for investigation, then remove or restrict access to logs containing sensitive data.
• Add CI/CD supply-chain monitoring for unexpected changes to action repositories, workflow files, and action dependency chains.
• Meet or document completion against the CISA KEV remediation expectation associated with the 2025-04-14 due date if subject to KEV-driven requirements.