tj-actions changed-files before 46 allows remote attackers to discover secrets by reading…
Priority CRITICAL 94Exploited in the wildCWE-506Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-506.
Summary
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Why it matters now
Exploitation Active In CISA KEV since 2025-03-18CISA due date 2025-04-08
EPSS 0.72092 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed changed-files (tj-actions): 46tj-actions/changed-files (GitHub Actions): 46.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tj-actions | changed-files | 1 to before 46 | 46 | Patch available | CNA |
| — | tj-actions/changed-files (GitHub Actions) | before 46.0.1 | 46.0.1 | Patch available | GHSA-mrrh-fwg8-r2c3 |
- changed-files Vendortj-actions Affected 1 to before 46 Fixed in 46 Patch available CNA
- tj-actions/changed-files (GitHub Actions) Vendor— Affected before 46.0.1 Fixed in 46.0.1 Patch available GHSA-mrrh-fwg8-r2c3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:* | up to 45.0.7 | Vulnerable | tj-actions |
- cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:* Versions up to 45.0.7 Vulnerable ·tj-actions
Remediation
- Fix · CNA changed-files (tj-actions) Fixed in 46
- Fix · GHSA-mrrh-fwg8-r2c3 tj-actions/changed-files (GitHub Actions) Fixed in 46.0.1 Advisory →
Timeline
- 2025-03-18 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-30066
- 2026-10-03 Alias added: GHSA-mrrh-fwg8-r2c3
References
Exploit 2
Advisory 9
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
- https://news.ycombinator.com/item?id=43368870
- https://news.ycombinator.com/item?id=43367987
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/
- https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
- https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond
- https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack
- https://nvd.nist.gov/vuln/detail/CVE-2025-30066
- https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066
Other 17
- https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
- https://github.com/tj-actions/changed-files/issues/2463
- https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463
- https://github.com/rackerlabs/genestack/pull/903
- https://github.com/chains-project/maven-lockfile/pull/1111
- https://github.com/espressif/arduino-esp32/issues/11127
- https://github.com/modal-labs/modal-examples/issues/1100
- https://github.com/tj-actions/changed-files/issues/2464
- https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
- https://github.com/tj-actions/changed-files/issues/2477
- https://github.com/tj-actions/changed-files/security/advisories/GHSA-mw4p-6x4p-x5m5
- https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066
- https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised
- https://github.com/tj-actions/changed-files/releases/tag/v46.0.1
- https://github.com/tj-actions/changed-files
- https://blog.gitguardian.com/compromised-tj-actions
More tj-actions Changed-files vulnerabilities
- TI-2023-28311 tj-actions/changed-files command injection in output filenames CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-30066 · CVE Program
- CVE-2025-30066 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-mrrh-fwg8-r2c3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences