CVE-2025-30066
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
tj-actions changed-files GitHub Action
CVSS
8.6HighExploit odds (EPSS)72.1%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
- 46changed-filesCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Description
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
Text from CVE List
Affected versions 1
- changed-filesaffected: 1 before 46CVE List
References 22
- github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193Advisoryvia CVE List
- stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromisedAdvisoryvia CVE List
- stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respondAdvisoryvia CVE List
- sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attackAdvisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2025-30066Referencevia CISA KEV
- github.com/tj-actions/changed-files/issues/2463Referencevia CVE List
- semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/Referencevia CVE List
- news.ycombinator.com/item?id=43368870Referencevia CVE List
- web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463Referencevia CVE List
- news.ycombinator.com/item?id=43367987Referencevia CVE List
- github.com/rackerlabs/genestack/pull/903Referencevia CVE List
- github.com/chains-project/maven-lockfile/pull/1111Referencevia CVE List
- sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/Referencevia CVE List
- github.com/espressif/arduino-esp32/issues/11127Referencevia CVE List
- github.com/modal-labs/modal-examples/issues/1100Referencevia CVE List
- github.com/tj-actions/changed-files/issues/2464Referencevia CVE List
- github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28Referencevia CVE List
- wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066Referencevia CVE List
- github.com/tj-actions/changed-files/issues/2477Referencevia CVE List
- blog.gitguardian.com/compromised-tj-actions/Referencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066Referencevia CVE List
- cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066Referencevia CVE List