CVE-2025-30154

Published Mar 19, 2025

Last updated 5 months ago

Exploit known CVSS high 8.6

GitHub Actions

Overview

Description: reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Source: security-advisories@github.com
NVD status: Analyzed
Products: action-ast-grep, action-composite-template, action-setup, action-shellcheck, action-staticcheck, action-typos

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.6
Impact score: 4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
Exploit added on: Mar 24, 2025
Exploit action due: Apr 14, 2025
Required action: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-506
nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:reviewdog:action-ast-grep:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "803018C3-8A54-4257-8AA0-34C8A44C158B",
            "versionEndExcluding": "1.26.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:reviewdog:action-composite-template:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0CA481E1-E3A5-4D2B-9F18-84F640CAB12E",
            "versionEndExcluding": "0.20.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:reviewdog:action-setup:1:*:*:*:*:*:*:*",
            "matchCriteriaId": "D5FB52BE-EC23-4D44-99C9-A87DA1C1146B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:reviewdog:action-shellcheck:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B5BC0E9A-9A25-44F7-B93D-F8B37816EA90",
            "versionEndExcluding": "1.29.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:reviewdog:action-staticcheck:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E197FFD7-ACAE-470F-8734-B49CD171C9B1",
            "versionEndExcluding": "1.26.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:reviewdog:action-typos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B2894269-B4A0-4BA1-BEB9-493B5E4D409B",
            "versionEndExcluding": "1.17.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References