CVE-2025-30066: tj-actions/changed-files GitHub Action leaks secrets via modified tags

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with active exploitation, high EPSS, and a supply-chain vector that exposes secrets across many CI/CD pipelines.

What it is

The tj-actions/changed-files GitHub Action was compromised: tags v1 through v45.0.7 were modified on 2025-03-14 and 2025-03-15 to point at commit 0e58ed8, which contained malicious updateFeatures code. That code caused secrets to be exposed by reading actions logs, so any workflow referencing the affected tags could leak credentials. The flaw is a supply-chain compromise of a widely used third-party action, not a coding bug in the action's intended logic.

Impact

An attacker who can read the workflow's actions logs gains access to secrets present in the runner environment, such as tokens and credentials. This can lead to downstream compromise of repositories, cloud accounts and CI/CD pipelines.

Attack surface

Reached remotely over the network through GitHub Actions workflows that reference the affected tags; no authentication or user interaction is required by the attacker. The malicious code runs automatically when the workflow executes.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-03-18, and EPSS gives a 30-day probability of 0.69794 (99.3rd percentile). Multiple references are tagged Exploit, confirming active exploitation.

What to do

• Immediately stop using affected tj-actions/changed-files tags v1 through v45.0.7 and pin the action to a known-good commit SHA or a fixed version.
• Rotate all secrets, tokens and credentials that were accessible to workflows that ran the compromised action during 2025-03-14 and 2025-03-15.
• Audit workflow run logs and repository history for unauthorized access or changes made with exposed credentials.
• Apply the vendor and CISA mitigations, and follow BOD 22-01 guidance for cloud services or discontinue use if mitigations are unavailable.
• Adopt hardening controls for GitHub Actions, such as restricting third-party actions and using a hardened runner.

Detection

• Search workflow files and run logs for references to tj-actions/changed-files tags v1 through v45.0.7 or commit 0e58ed8.
• Review GitHub Actions logs from 2025-03-14 and 2025-03-15 for unexpected output or secret exposure.
• Monitor for anomalous use of CI/CD credentials and tokens that were present in affected workflow runs.
• Check repository and organization audit logs for unexpected changes or access following the compromise window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.