Security readout for executives and security teams
Plain-English summary
A trusted GitHub Action used by reviewdog was briefly compromised, causing secrets exposed to affected workflow runs to be written into GitHub Actions logs. The business risk is credential leakage from CI/CD, which can enable follow-on access to code, cloud, package, or deployment systems.
Executive priority
Treat this as a credential exposure incident, not just a dependency update. Prioritize teams with deployment, cloud, registry, or production secrets in GitHub Actions.
Technical view
reviewdog/action-setup@v1 was compromised on March 11, 2025, from 18:42 to 20:31 UTC. Malicious code dumped exposed secrets to GitHub Actions workflow logs. Dependent reviewdog actions using action-setup@v1 were also affected, regardless of version or pinning method.
Likely exposure
Organizations are exposed if GitHub Actions workflows ran reviewdog/action-setup@v1 or the listed dependent reviewdog actions during the compromise window.
Exploitation context
CISA KEV listing indicates known exploitation. The source bundle supports a time-bounded supply-chain compromise, not evidence of ongoing compromise after the stated window.
Researcher notes
Affected dependent actions named in the bundle are action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, and action-typos. Evidence is strong for the stated window, but the bundle does not prove which individual organizations had secrets exposed.
Mitigation direction
- Identify affected workflow runs during the compromise window.
- Rotate any secrets available to affected GitHub Actions jobs.
- Remove or update compromised reviewdog action references per vendor guidance.
- Restrict CI secrets to least privilege and protected contexts.
- Review GitHub Actions logs for exposed secret material.
Validation and detection
- Search workflow history for listed reviewdog actions in the affected time window.
- Inventory secrets available to those workflow jobs.
- Check Actions logs for unexpected secret disclosure.
- Confirm rotated credentials are no longer valid.
- Review vendor advisory and referenced commits for remediation context.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-506: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-30154 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvcCVE reference · x_refsource_CONFIRM
- https://github.com/reviewdog/reviewdog/issues/2079CVE reference · x_refsource_MISC
- https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887CVE reference · x_refsource_MISC
- https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ecCVE reference · x_refsource_MISC
- https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setupCVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30154CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Embedded Malicious Code
Embedded Malicious Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.