Vulnerabilitycritical

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

The Hacker Newsby @TheHackersNewsMar 18, 2025 · 04:03 UTC (Mar 18, 2025)3 min read3

Read at thehackernews.com

Analyze CVE-2025-30066 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2025-30066 CVE-2023-49291

Tags: cve-2025-30066 cve-2023-49291 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-49291	tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events	9.8	1%	PoC ×2	Dec 5, 2023
CVE-2025-30066	Supply Chain Compromise of tj-actions/changed-files GitHub Action Exposes CI/CD Secrets	8.6	72%	KEVPoC ×2	Mar 15, 2025 KEV Mar 18, 2025

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  Mar 17, 2025 Vulnerability / Cloud Security Cybersecurity researchers are calling attention to an incident in which the popular GitHub Action tj-actions/changed-files was compromised to leak secrets from repositories using the continuous integration and continuous delivery (CI/CD) workflow.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.