This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitHub Action tj-actions/changed-files fixes a high-severity vulnerability
GitHub Action tj-actions/changed-files version 46.0.1 fixes a high-severity vulnerability [1][2].
An unauthenticated remote attacker can obtain secrets [3] from CI/CD environments because they are written to GitHub Actions output logs, if these logs are publicly accessible. The vulnerability was caused by a compromise of the action and by retroactively changing version tags to point to a malicious commit [2][4]. Detailed information about the vulnerability and the recommended procedure can be found at [4][5]. The vulnerability is already being actively exploited [6].
The vulnerability is present in product:
- *:tj-actions/changed-files;<=45.0.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2025-30066 at cve.org, NVD
- CWE-506: Embedded Malicious Code at cwe.mitre.org
The vulnerability was publicly disclosed 15. 3. 2025.
Links
- [1] https://github.com/tj-actions/changed-files/releases/tag/v46.0.1
- [2] https://github.com/advisories/GHSA-mrrh-fwg8-r2c3
- [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/about-secrets
- [4] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
- [5] https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
- [6] https://www.cisa.gov/news-events/alerts/2025/03/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
By CESNET, z.s.p.o. Michaela Ručková on 20. 3. 2025.