CVE-2025-30154
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
Description
CVE-2025-30154 is a high-severity supply chain compromise affecting the reviewdog/action-setup GitHub Action and several dependent actions including action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, and action-typos. On March 11, 2025, between 18:42 and 20:31 UTC, malicious code was injected into the v1 tag of reviewdog/action-setup that dumps exposed secrets to GitHub Actions workflow logs. With a CVSS v3.1 score of 8.6 and an EPSS score of 15.40% at the 94th percentile, CVE-2025-30154 represents a significant supply chain security threat. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| reviewdog | action-ast-grep | < 1.26.2 |
| reviewdog | action-composite-template | < 0.20.2 |
| reviewdog | action-setup | 1 |
| reviewdog | action-shellcheck | < 1.29.2 |
| reviewdog | action-staticcheck | < 1.26.2 |
| reviewdog | action-typos | < 1.17.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887(Patch)
- https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec(Patch)
- https://github.com/reviewdog/reviewdog/issues/2079(Issue Tracking, Vendor Advisory)
- https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc(Vendor Advisory)
- https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30154(US Government Resource)
Weakness Type
CWE-506: Embedded Malicious Code
CVE-2025-30154 is classified under CWE-506 (Embedded Malicious Code), which describes software that contains code intentionally inserted to perform unauthorized, harmful functions. In this case, the reviewdog/action-setup@v1 GitHub Action was compromised by a threat actor who injected malicious code designed to exfiltrate secrets from CI/CD workflow environments by dumping them to workflow logs. This type of supply chain attack leverages the trust relationship between dependent projects and shared actions.
Learn more: CWE-506 — Embedded Malicious Code
Impact Analysis
The impact of CVE-2025-30154 is primarily on confidentiality, rated as High with a Changed scope (S:C), meaning the compromise extends beyond the vulnerable component to affect the broader CI/CD environment. Confidentiality (High) is compromised because all secrets exposed to GitHub Actions workflows — including API tokens, deployment keys, cloud credentials, NPM tokens, and other sensitive environment variables — are dumped to workflow logs where they can be harvested by the attacker. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), as any repository using the compromised action version automatically executes the malicious code during CI/CD runs. The EPSS score of 15.40% at the 94th percentile indicates a very high probability of exploitation, and the Changed scope means leaked secrets can be used to compromise downstream systems, repositories, cloud infrastructure, and deployment pipelines far beyond the initially affected workflow.
Exploit Maturity
CVE-2025-30154 demonstrates confirmed active exploitation, as CISA has added it to the Known Exploited Vulnerabilities catalog. Public exploit analysis is available via the Wiz.io blog post detailing the supply chain attack mechanism. The compromise occurred during a specific time window on March 11, 2025, and affected all workflows that ran during or after the malicious code injection until the tags were remediated. The EPSS score of 15.40% at the 94th percentile reflects the widespread adoption of reviewdog actions across thousands of open-source and private repositories. Any repository that used pinned tags (v1) rather than commit SHA pinning for the affected actions was automatically exploited when their CI/CD pipelines ran during the compromise window.
Remediation
-
Immediately audit workflow logs for any GitHub Actions runs that used reviewdog/action-setup@v1 or dependent actions (action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos) between March 11, 2025, 18:42 UTC and March 15, 2025. Any secrets visible in those logs should be considered compromised.
-
Rotate all compromised credentials including API tokens, deployment keys, cloud provider credentials, NPM/PyPI tokens, database passwords, and any other secrets that were exposed as environment variables in affected workflows. Prioritize credentials with broad access.
-
Update to patched versions of the affected actions: action-ast-grep >= 1.26.2, action-composite-template >= 0.20.2, action-shellcheck >= 1.29.2, action-staticcheck >= 1.26.2, action-typos >= 1.17.2. For action-setup, ensure you are using a version that references the clean commit.
-
Pin GitHub Actions to full commit SHAs instead of mutable tags (v1, v2). This prevents tag-based supply chain attacks by ensuring the exact code that was audited is the code that runs. Use tools like Dependabot or Renovate to manage updates.
-
Implement GitHub Actions security hardening: enable workflow permissions to read-only by default, use CODEOWNERS files to restrict workflow modifications, configure branch protection rules, and consider using StepSecurity Harden-Runner to monitor and restrict network egress from workflows.
Technical Details
CVE-2025-30154 is a supply chain attack targeting the reviewdog ecosystem of GitHub Actions. The attackers compromised the reviewdog/action-setup repository and modified the v1 mutable tag to point to a malicious commit containing code that extracts CI/CD secrets during workflow execution. The malicious code dumps all environment variables and secrets accessible to the workflow runner into the GitHub Actions workflow logs, which could then be harvested by the attacker. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N reflects that the attack is network-accessible, requires no interaction or privileges, and has Changed scope — meaning the impact extends beyond the compromised action into the broader environment of repositories using it. Multiple dependent actions (action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos) that internally referenced action-setup@v1 were automatically compromised regardless of their own version pinning, demonstrating the cascading nature of supply chain attacks in the GitHub Actions ecosystem.
Frequently Asked Questions
Is CVE-2025-30154 being actively exploited?
Yes. The compromise was actively exploited during the time window of March 11, 2025, and CISA has confirmed active exploitation by adding CVE-2025-30154 to the KEV catalog. Any repository that ran workflows using the compromised actions during the affected period had its secrets exposed.
What products are affected by CVE-2025-30154?
The following reviewdog GitHub Actions are affected: action-setup (v1), action-ast-grep (< 1.26.2), action-composite-template (< 0.20.2), action-shellcheck (< 1.29.2), action-staticcheck (< 1.26.2), and action-typos (< 1.17.2). Any GitHub repository using these actions with tag-based pinning was vulnerable.
How do I fix CVE-2025-30154?
Update all affected reviewdog actions to their patched versions and rotate any secrets that were exposed during the compromise window. Pin all GitHub Actions to full commit SHAs rather than mutable tags to prevent future supply chain attacks.
How severe is CVE-2025-30154?
CVE-2025-30154 is rated High with a CVSS score of 8.6. While it primarily impacts confidentiality through secret exfiltration, the Changed scope means compromised credentials can be used to attack downstream systems, potentially causing cascading security incidents across cloud infrastructure and deployment pipelines.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.