PT-2025-11694 · Reviewdog · Reviewdog/Action-Setup+5

Published 2025-03-12 · Updated 2026-04-01 · CVE-2025-30154

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions reviewdog/action-setup version 1

Description The GitHub Action reviewdog/action-setup was compromised between March 11, 2025, 18:42 and 20:31 UTC with malicious code. This code dumps exposed secrets to GitHub Actions Workflow Logs. Actions that utilize reviewdog/action-setup@v1, including reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos, are also affected. The malicious code enabled attackers to steal a Personal Access Token (PAT) from the tj-bot-actions account and modify the tj-actions/changed-files repository.

Recommendations Do not use reviewdog/action-setup version 1.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

BDU:2025-03223

CVE-2025-30154

GHSA-QMG3-HPQR-GQVC

Affected Products

Reviewdog/Action-Ast-Grep

Reviewdog/Action-Composite-Template

Reviewdog/Action-Setup

Reviewdog/Action-Shellcheck

Reviewdog/Action-Staticcheck

Reviewdog/Action-Typos

References · 183

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30154.json · Exploit
• 🔥 https://wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup · Exploit
• https://github.com/reviewdog/reviewdog/issues/2079 · Vendor Advisory
• https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc · Vendor Advisory
• https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887 · Patch
• https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-30154 · Security Note
• https://bdu.fstec.ru/vul/2025-03223 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30154 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qmg3-hpqr-gqvc · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30154 · Security Note
• https://github.com/reviewdog/reviewdog · Note
• https://github.com/reviewdog/action-setup/commit/3f401fe · Note
• https://twitter.com/GhostLoginHacks/status/1911740314978525205 · Twitter Post
• https://twitter.com/CyberExperts10/status/1925297266186662103 · Twitter Post