tj-actions · changed-files GitHub Action
The tj-actions changed-files GitHub Action, before version 46, contains an embedded malicious code flaw: tags v1 through v45.0.7 were altered to point at a commit containing malicious code. A remote attacker can exploit this over the network without authentication or user interaction to discover secrets exposed in workflow action logs.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
First seen exploited 1 day before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 3 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
compromised upstream action tags distributed malicious code
tags v1 through v45.0.7 were affected
secrets exposed in CI workflow logs
allows remote attackers to discover secrets by reading actions logs
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: tj-actions/changed-files.
Upgrade to 46.0.1 or later
Set the version to 46.0.1 or later in your version.
The first fix for CVE-2025-30066. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 46.0.1 | 46.0.1 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.