Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-30066

CVE-2025-30066HIGH

tj-actions changed-files GitHub Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  N    8.6   .7209   99.4   YES

AFFECTED
  Product        Versions  Fixed
  changed-files  1 –       —

TIMELINE
  Mar 15  Reserved by mitre
  Mar 15  Published (CNA: mitre)
  Mar 18  Added to CISA KEV, remediation due 2025-04-08
  Sep 24  EXPLOIT PUBLISHED — CVE-2025-30066 (tj-actions changed-files). Public exploit reference added.

CWE-506 · CNA: mitre · CVSS v3.1 · 21 references · NVD status: Analyzed · KEV due April 8, 2025

Description

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
March 15, 2025	Reserved	Reserved by mitre
March 15, 2025	Published	Published (CNA: mitre)
March 18, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-04-08
September 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-30066 (tj-actions changed-files). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
tj-actions	changed-files	—	1	—

Weaknesses

CWE-506

References (21)

https://blog.gitguardian.com/compromised-tj-actions/ [Exploit, Third Party Advisory]
https://github.com/chains-project/maven-lockfile/pull/1111 [Issue Tracking]
https://github.com/espressif/arduino-esp32/issues/11127 [Issue Tracking]
https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193 [Product]
https://github.com/modal-labs/modal-examples/issues/1100 [Issue Tracking]
https://github.com/rackerlabs/genestack/pull/903 [Issue Tracking]
https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 [Product]
https://github.com/tj-actions/changed-files/issues/2463 [Issue Tracking]
https://github.com/tj-actions/changed-files/issues/2464 [Issue Tracking]
https://github.com/tj-actions/changed-files/issues/2477 [Issue Tracking]
https://news.ycombinator.com/item?id=43367987 [Issue Tracking, Third Party Advisory]
https://news.ycombinator.com/item?id=43368870 [Issue Tracking, Third Party Advisory]
https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/ [Third Party Advisory]
https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/ [Mitigation, Third Party Advisory]
https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463 [Issue Tracking]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066 [US Government Resource]
https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 [Third Party Advisory, US Government Resource]
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised [Exploit, Mitigation, Third Party Advisory]
https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond [Third Party Advisory]
https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack [Third Party Advisory]
https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 [Third Party Advisory]

Authoritative record: CVE-2025-30066 at cve.org

Vendors: tj-actions

Weaknesses: CWE-506

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-30066 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.