CVE-2025-30066

CVE-2025-30066 affects tj-actions/changed-files before 46, where a malicious commit (0e58ed8) was used to alter tags (e.g., v1, v45.0.7) and cause secrets to be read from GitHub Actions logs. Public reports and advisories (CISA, OSV, GHSA) confirm secrets disclosure via runners’ logs in affected ...

CVE-2023-51664

The CVE refers to the GitHub Action tj-actions/changed-files. Before version 41.0.0, the action allowed command injection through changed filenames, enabling potential arbitrary code execution on the GitHub Runner and possible secret leakage. Affected component: tj-actions/changed-files (GitHub A...