GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-49291 | tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. NVD description · AI analysis pending | 9.8 | 1% | PoC ×2 |
| — | |
| CVE-2025-30066 | Supply Chain Compromise of tj-actions/changed-files GitHub Action Exposes CI/CD Secrets CVE-2025-30066 is not a traditional code bug but a supply chain compromise: on 2025-03-14 and 2025-03-15, a threat actor modified the code behind every published tag (v1 through v45.0.7) of the widely used tj-actions/changed-files GitHub Action to point at commit 0e58ed8, which contained malicious 'updateFeatures' code. The flaw is triggered whenever a GitHub Actions workflow invokes any of these affected tags during the compromise window; the embedded code dumps the runner's environment variables into the workflow logs. Anyone able to read the actions logs — including public logs on public repositories — can discover repository secrets such as GitHub tokens, API keys, and cloud credentials, enabling account takeover and lateral movement. Public reporting indicates roughly 23,000 repositories/organizations were affected, with Coinbase initially targeted and 218 of its repositories' CI/CD secrets exposed; the attack was traced back to a compromised GitHub token. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-03-18, and both GitGuardian and StepSecurity published detection and incident analyses. Do: Update workflows from tj-actions/changed-files to v46 or later, or better, pin the action to a verified commit SHA rather than a mutable tag. Review all workflow run logs generated between 2025-03-14 and 2025-03-15 for dumped environment variables and rotate every credential that could have been exposed (GitHub PATs, cloud keys, deploy tokens), checking downstream systems and logs for abuse of those secrets. | 8.6 | 70% | KEV PoC ×2 |
| large≈23,000+ repositories and their organizations (public incident reporting counted over 23,000 affected repositories) |
Full article713 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 17, 2025Vulnerability / Cloud Security
Cybersecurity researchers are calling attention to an incident in which the popular GitHub Action tj-actions/changed-files was compromised to leak secrets from repositories using the continuous integration and continuous delivery (CI/CD) workflow.
The incident involved the tj-actions/changed-files GitHub Action, which is used in over 23,000 repositories. It's used to track and retrieve all changed files and directories.
The supply chain compromise has been assigned the CVE identifier CVE-2025-30066 (CVSS score: 8.6). The incident is said to have taken place sometime before March 14, 2025.
"In this attack, the attackers modified the action's code and retroactively updated multiple version tags to reference the malicious commit," StepSecurity said. "The compromised Action prints CI/CD secrets in GitHub Actions build logs."
The net result of this behavior is that should the workflow logs be publicly accessible, they could lead to the unauthorized exposure of sensitive secrets when the action is run on the repositories.
This includes AWS access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA Keys, among others. That said, there is no evidence that the leaked secrets were siphoned to any attacker-controlled infrastructure.
Specifically, the maliciously inserted code is designed to run a Python script hosted on a GitHub gist that dumps the CI/CD secrets from the Runner Worker process. It's said to have originated from an unverified source code commit. The GitHub gist has since been taken down.
"tj-actions/change-files is used in an organization's software development pipelines," Dimitri Stiliadis, CTO and co-founder of Endor Labs, said in a statement shared with The Hacker News. "After developers write and review code, they typically publish into the main branch of their repository. From there 'pipelines' take it, build it for production, and deploy it."
"tj-actions/change-files helps detect file changes in a repository. It allows you to check which files have been added, modified, or deleted between commits, branches, or pull requests."
"The attackers modified the action's code and retroactively updated multiple version tags to reference the malicious commit. The compromised Action now executes a malicious Python script that dumps CI/CD secrets, impacting thousands of CI pipelines."
Cybersecurity firm Sysdig said the compromise of tj-actions/changed-files highlights the growing risk of supply chain attacks in CI/CD environments. Aqua, which also examined the issue, noted that the malicious payload was "carefully concealed" to evade detection by automated scanning tools.
The project maintainers have stated that the unknown threat actor(s) behind the incident managed to compromise a GitHub personal access token (PAT) used by @tj-actions-bot, a bot with privileged access to the compromised repository.
Following the discovery, the account's password has been updated, authentication has been upgraded to use a passkey, and its permissions levels have been updated such that it follows the principle of least privilege. GitHub has also revoked the compromised PAT.
"The Personal access token affected was stored as a GitHub action secret which has since been revoked," the maintainers added. "Going forward no PAT would be used for all projects in the tj-actions organization to prevent any risk of reoccurrence."
Anyone who uses the GitHub Action is advised to update to the latest version (46.0.1) as soon as possible. Users are also advised to review all workflows executed between March 14 and March 15 and check for "unexpected output under the changed-files section."
This is not the first time a security issue has been flagged in the tj-actions/changed-files Action. In January 2024, security researcher Adnan Khan revealed details of a critical flaw (CVE-2023-49291, CVSS score: 9.8) affecting tj-actions/changed-files and tj-actions/branch-names that could pave the way for arbitrary code execution.
The development once again underscores how open-source software remains particularly susceptible to supply chain risks, which could then have serious consequences for several downstream customers at once.
"As of March 15, 2025, all versions of tj-actions/changed-files were found to be affected, as the attacker managed to modify existing version tags to make them all point to their malicious code," cloud security firm Wiz said.
"Customers who were using a hash-pinned version of tj-actions/changed-files would not be impacted, unless they had updated to an impacted hash during the exploitation timeframe."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/github-action-compromise-puts-cicd.html