CVE-2025-30154
reviewdog/action-setup GitHub Action Embedded Mali - [Actively Exploited]
Description
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
INFO
Published Date :
March 19, 2025, 4:15 p.m.
Last Modified :
March 29, 2025, 1 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
4.0
Exploitability Score :
3.9
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc ; https://nvd.nist.gov/vuln/detail/CVE-2025-30154
Public PoC/Exploit Available at Github
CVE-2025-30154 has a 1 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2025-30154
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-30154.
| URL | Resource |
|---|---|
| https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887 | Patch |
| https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec | Patch |
| https://github.com/reviewdog/reviewdog/issues/2079 | Issue Tracking Vendor Advisory |
| https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc | Vendor Advisory |
| https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup | Exploit Third Party Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-30154 vulnerability anywhere in the article.
-
The Register
Oracle Health reportedly warns of info leak from legacy server
Infosec in brief Oracle Health appears to have fallen victim to an info stealing attack that has led to patient data stored by American hospitals being plundered. Oracle Health was formed when Big Red ... Read more
-
TheCyberThrone
CISA KEV Catalog Update Part VII – March 2025
CISA’s add vulnerabilities related to Sitecore CMS and Reviewdog GitHub Actions to its Known Exploited Vulnerabilities (KEV) catalog1. Sitecore CMS VulnerabilitiesCISA has identified critical vulnerab ... Read more
The following table lists the changes that have been made to the
CVE-2025-30154 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Mar. 29, 2025
Action Type Old Value New Value Changed Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. -
Initial Analysis by [email protected]
Mar. 25, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Added CWE NVD-CWE-Other Added CPE Configuration OR *cpe:2.3:a:reviewdog:action-ast-grep:*:*:*:*:*:*:*:* versions up to (excluding) 1.26.2 *cpe:2.3:a:reviewdog:action-composite-template:*:*:*:*:*:*:*:* versions up to (excluding) 0.20.2 *cpe:2.3:a:reviewdog:action-setup:1:*:*:*:*:*:*:* *cpe:2.3:a:reviewdog:action-shellcheck:*:*:*:*:*:*:*:* versions up to (excluding) 1.29.2 *cpe:2.3:a:reviewdog:action-staticcheck:*:*:*:*:*:*:*:* versions up to (excluding) 1.26.2 *cpe:2.3:a:reviewdog:action-typos:*:*:*:*:*:*:*:* versions up to (excluding) 1.17.2 Added Reference Type GitHub, Inc.: https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec Types: Patch Added Reference Type GitHub, Inc.: https://github.com/reviewdog/reviewdog/issues/2079 Types: Issue Tracking, Vendor Advisory Added Reference Type GitHub, Inc.: https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc Types: Vendor Advisory Added Reference Type GitHub, Inc.: https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup Types: Exploit, Third Party Advisory -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Mar. 25, 2025
Action Type Old Value New Value Added Date Added 2025-03-24 Added Due Date 2025-04-14 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability -
New CVE Received by [email protected]
Mar. 19, 2025
Action Type Old Value New Value Added Description reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Added CWE CWE-506 Added Reference https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887 Added Reference https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec Added Reference https://github.com/reviewdog/reviewdog/issues/2079 Added Reference https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc Added Reference https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-30154 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-30154
weaknesses.