CVE-2025-30066

CVE-2025-30066 is not a traditional code bug but a supply chain compromise: on 2025-03-14 and 2025-03-15, a threat actor modified the code behind every published tag (v1 through v45.0.7) of the widely used tj-actions/changed-files GitHub Action to point at commit 0e58ed8, which contained malicious 'updateFeatures' code. The flaw is triggered whenever a GitHub Actions workflow invokes any of these affected tags during the compromise window; the embedded code dumps the runner's environment variables into the workflow logs. Anyone able to read the actions logs — including public logs on public repositories — can discover repository secrets such as GitHub tokens, API keys, and cloud credentials, enabling account takeover and lateral movement. Public reporting indicates roughly 23,000 repositories/organizations were affected, with Coinbase initially targeted and 218 of its repositories' CI/CD secrets exposed; the attack was traced back to a compromised GitHub token. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-03-18, and both GitGuardian and StepSecurity published detection and incident analyses.

What to do: Update workflows from tj-actions/changed-files to v46 or later, or better, pin the action to a verified commit SHA rather than a mutable tag. Review all workflow run logs generated between 2025-03-14 and 2025-03-15 for dumped environment variables and rotate every credential that could have been exposed (GitHub PATs, cloud keys, deploy tokens), checking downstream systems and logs for abuse of those secrets.