LiveActive security incident?Get immediate response
CVE Record

CVE-2025-30066: tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

HighCVSS 8.6Known exploitedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-30066 is a GitHub Actions supply-chain compromise in tj-actions/changed-files. For a short window, widely used action tags were redirected to malicious code that could expose repository secrets in workflow logs. Organizations should treat affected workflow runs as potential secret disclosure events.

Executive priority

Treat this as an urgent credential exposure incident, not only a dependency update. Prioritize repositories with production deployment credentials, cloud keys, package publishing tokens, or customer-impacting secrets in GitHub Actions.

Technical view

The CVE describes malicious code in commit 0e58ed8 reached through modified tags v1 through v45.0.7 on March 14-15, 2025. The issue is classified as CWE-506 and CVSS 8.6, with high confidentiality impact and no stated integrity or availability impact.

Likely exposure

Exposure is likely for repositories that used tj-actions/changed-files before v46, especially pinned version tags v1 through v45.0.7, during the compromise window. Risk depends on whether secrets were available to those workflows and whether logs were accessible.

Exploitation context

Known exploitation is supported by the CISA KEV listing. Public reports describe a real supply-chain attack against GitHub Actions tags, where secrets could be discovered through action logs. The bundle does not establish broader post-exposure attacker activity in every affected repository.

Researcher notes

The evidence supports a compromised dependency tag chain and log-based secret disclosure. Validate exact exposure from workflow usage, secret scoping, and log retention. Avoid assuming compromise of systems beyond credentials exposed through affected GitHub Actions runs.

Mitigation direction

  • Upgrade tj-actions/changed-files to v46 or later.
  • Rotate secrets available to affected workflow runs.
  • Review and restrict access to workflow logs.
  • Pin third-party GitHub Actions to full-length commit SHAs.
  • Follow vendor and GitHub guidance for hardening Actions workflows.

Validation and detection

  • Inventory workflows referencing tj-actions/changed-files.
  • Identify runs using v1 through v45.0.7 on March 14-15, 2025.
  • Review logs for unexpected secret exposure indicators.
  • Check which repository or organization secrets were available to affected jobs.
  • Confirm affected credentials were rotated or revoked.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-506: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-30066 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (3.1)
Known Exploited
Yes
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
22Source links

CISA KEV status

Status
Known exploited
Source
CISA / ADP
Date added
Not provided

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.6High
CVSS 3.1 vector shape for CVE-2025-30066Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tj-actionschanged-files1unaffected
Weakness

CWE details

CWE-506

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-506 · source CWE mapping

Embedded Malicious Code

Embedded Malicious Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs