CVE-2025-30154

Description

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2025-30154
• https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction
• https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6724
• https://github.com/reviewdog/reviewdog/issues/2079
• https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887
• https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec
• https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup