U.S. CISA adds Sitecore CMS and XP, and GitHub Action flaws to its Known Exploited Vulnerabilities catalog

CVE-2019-9874 is a deserialization flaw (CWE-502) in the Sitecore.Security.AntiCSRF module that lets an unauthenticated attacker run arbitrary code remotely. It is triggered by sending a crafted serialized .NET object in the HTTP POST parameter __CSRFTOKEN, which the module deserializes without validation. Successful exploitation yields full remote code execution with the privileges of the web application, with confidentiality, integrity, and availability all impacted. Users of Sitecore CMS 7.0 through 7.2 and Sitecore Experience Platform (XP) 7.5 through 8.2 are affected. The flaw carries a critical CVSS 3.1 score of 9.8, a very high EPSS score of 83.7%, and was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-26, indicating active exploitation in the wild; ransomware use is currently unknown.

Do: Upgrade affected Sitecore CMS (7.0–7.2) and XP (7.5–8.2) deployments to a patched, currently supported release per Sitecore's security guidance, as required by CISA's KEV/BOD 22-01 action for federal agencies. Until patched, restrict network access to vulnerable Sitecore instances and monitor IIS/web logs for unauthenticated POST requests containing oversized or anomalous __CSRFTOKEN values. A public technical advisory with exploitation details is available from Synacktiv, so treat exploitability as confirmed.

The reviewdog/action-setup GitHub Action, which installs the reviewdog tool, was compromised in a supply chain attack on March 11, 2025, between 18:42 and 20:31 UTC, when malicious code was embedded in the action-setup@v1 tag (CWE-506). Any workflow that invoked reviewdog/action-setup@v1 during that window executed the malicious code, including runs of reviewdog/action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, and action-typos, which all depend on action-setup@v1; because the v1 tag itself was modified, the compromise applied regardless of version or pinning method. The injected code dumped exposed secrets, such as CI/CD credentials, to GitHub Actions workflow logs, giving the attacker access to harvested tokens and secrets; public reporting links the campaign to an initial targeting of Coinbase and documents 218 repositories whose secrets were exposed. Only GitHub repositories whose workflows ran one of the six affected actions during the roughly two-hour window are affected. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-03-24, and EPSS estimates a 2.4% probability of exploitation in the next 30 days.

Do: Audit GitHub Actions workflow logs for runs executed between March 11, 2025 18:42 and 20:31 UTC that invoked any of the six affected reviewdog actions, and rotate or revoke any secrets that appear in those logs (CI/CD tokens, cloud and API credentials). Update to the remediated action-setup@v1 or pin the action to a known-good full commit SHA, and apply mitigations per CISA/vendor instructions (BOD 22-01 guidance for cloud services) or discontinue use if mitigations are unavailable. Note that pinning to a mutable tag alone did not prevent this compromise, so prefer full-SHA pinning.