EXPOSURES › CVE-2025-30066

CVE-2025-30066

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2025-03-18 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-30066 ↗

⌖ EXPLOITED IN THE WILD SHAME 50/100 exploited-in-wild

A malicious code vulnerability in a popular GitHub Action exposed sensitive secrets, including AWS keys and PATs, through workflow logs, actively exploited in the wild.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

tj-actions · vendor changed-files GitHub Action · product

DESCRIPTION

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.