GitHub

Description

Vulnerabilities

• CVE-2025-30066

  The tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading actions logs.

References

• supply-chain-compromise-third-party-github-action-cve-2025-30066(opens in a new tab)
• ghsa-mrrh-fwg8-r2c3(opens in a new tab)
• supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction(opens in a new tab)