CVE-2025-30154

published 2025-03-19

CVE-2025-30154: reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with…

Priority P1 80 high 8.6 CVSS 3.1

AV N AC L PR N UI N S C C H I N A N

KEV ITW

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
reviewdog	action-ast-grep	< 1.26.2	1.26.2
reviewdog	action-composite-template	< 0.20.2	0.20.2
reviewdog	action-setup	—	—
reviewdog	action-shellcheck	< 1.29.2	1.29.2
reviewdog	action-staticcheck	< 1.26.2	1.26.2
reviewdog	action-typos	< 1.17.2	1.17.2
reviewdog	reviewdog	—	—

Detection & IOCs extracted from sources · hover to see the quote

path install.sh↗

• → Check workflow logs for a double-encoded base64 string payload — its presence confirms successful execution of the malicious payload and potential secret exfiltration. ↗
• → The malicious payload did NOT use curl for exfiltration — secrets were dumped directly into workflow logs as a double-encoded base64 string, not sent to an external server. Detection should focus on log content, not outbound network traffic. ↗
• → Audit CI runner process memory dumping activity — Wiz Sensor detects this as a malicious behavior pattern associated with this attack. ↗
• → Downstream actions that transitively use reviewdog/action-setup@v1 are also affected regardless of their own pinning method: reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, reviewdog/action-typos. ↗
• → Monitor GitHub audit logs for suspicious bot activity such as deleting workflow logs or unusual merges, which may indicate abuse of compromised credentials obtained via this attack. ↗

• · No external C2 exfiltration was observed — secrets were only leaked within the workflow logs of affected repositories themselves, not sent to an attacker-controlled server. ↗
• · Hash-pinned versions of reviewdog/action-setup are NOT affected — only the v1 tag was compromised. However, downstream actions using v1 transitively are affected regardless of their own pinning. ↗
• · Workflows that do not explicitly reference custom secrets (e.g., token: ${{ secrets.MYSECRET }}) are unlikely to have had sensitive secrets compromised. ↗
• · The attacker likely force-pushed back to the older commit after achieving their goal, meaning the malicious commit may no longer be visible in the repository history — absence of malicious code in the current repo state does not mean the attack did not occur. ↗

CVSS provenance

nvd v3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vulncheck 8.6 HIGH

cisa 8.6 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-506