CVE-2025-30154

🗓️ 19 Mar 2025 15:15:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 13 Media mentions👁 289 Views

Reviewdog action setup compromised, exposing secrets in GitHub Workflow Logs via malicious code.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2025-30154	19 Mar 202500:00	–	attackerkb
BDU FSTEC	The vulnerability of the reviewdog/action-setup component of the GitHub collaborative development platform allows a hacker to disclose protected information.	26 Mar 202500:00	–	bdu_fstec
Circl	CVE-2025-30154	19 Mar 202515:45	–	circl
CISA KEV Catalog	reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability	24 Mar 202500:00	–	cisa_kev
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	24 Mar 202512:00	–	cisa
CISA	Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)	26 Mar 202512:00	–	cisa
CNNVD	Reviewdog 安全漏洞	19 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-30154 Multiple Reviewdog actions were compromised during a specific time period	19 Mar 202515:15	–	cvelist
GithubExploit	Exploit for Improper Input Validation in Toolkit_Project Toolkit	13 Mar 202613:04	–	githubexploit
Github Security Blog	Multiple Reviewdog actions were compromised during a specific time period	19 Mar 202515:19	–	github

NVD

Node

reviewdog action-ast-grepRange<1.26.2

reviewdog action-composite-templateRange<0.20.2

reviewdog action-setupMatch1

reviewdog action-shellcheckRange<1.29.2

reviewdog action-staticcheckRange<1.26.2

reviewdog action-typosRange<1.17.2

[
  {
    "vendor": "reviewdog",
    "product": "reviewdog",
    "versions": [
      {
        "version": "= 1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
wiz	www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
github	www.github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc
github	www.github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec
github	www.github.com/reviewdog/reviewdog/issues/2079
github	www.github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

17 Jun 2026 09:08Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.6

EPSS0.02296

SSVC