CVE-2025-30066
HIGH KEVtj-actions changed-files < 46 - Unauthenticated Secret Exposure via Malicious Commit
Title source: llmExploitation Summary
CVE-2025-30066 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 18, 2025. EIP tracks 3 public exploits from researchers including Checkmarx, Super-Vulnerable-Org, OS-pedrogustavobilro.
AI-analyzed exploit summary This repository contains a detection tool for CVE-2025-30066, designed to scan GitHub Actions logs for secrets using the Checkmarx 2ms tool. It automates the process of fetching workflow runs, downloading logs, and analyzing them for potential secret leaks.
Description
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
Exploits (3)
This repository contains a detection tool for CVE-2025-30066, designed to scan GitHub Actions logs for secrets using the Checkmarx 2ms tool. It automates the process of fetching workflow runs, downloading logs, and analyzing them for potential secret leaks.
This repository contains a functional proof-of-concept for CVE-2025-30066, demonstrating a compromised GitHub Action that executes malicious code via obfuscated eval statements. The exploit uses hex-encoded and base64-encoded payloads to bypass detection and execute arbitrary commands.
This repository contains a README referencing CVE-2025-30066, which pertains to a memory dump vulnerability in the GitHub Action 'tj-actions/changed-files' that could leak secrets. The content is a security advisory rather than an exploit PoC.
References (21)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N