Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-30154

CVE-2025-30154HIGH

reviewdog reviewdog — Multiple Reviewdog actions were compromised during a specific time period

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  N    8.6   .0244   83.7   YES

AFFECTED
  Product    Versions  Fixed
  reviewdog  = 1 –     —

TIMELINE
  Mar 17  Reserved by GitHub_M
  Mar 19  Published (CNA: GitHub_M)
  Mar 24  Added to CISA KEV, remediation due 2025-04-14

CWE-506 · CNA: GitHub_M · CVSS v3.1 · 6 references · KEV due April 14, 2025

Description

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 17, 2025	Reserved	Reserved by GitHub_M
March 19, 2025	Published	Published (CNA: GitHub_M)
March 24, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-04-14

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
reviewdog	reviewdog	—	= 1	—

Weaknesses

CWE-506

References (6)

https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887 [x_refsource_MISC]
https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec [x_refsource_MISC]
https://github.com/reviewdog/reviewdog/issues/2079 [x_refsource_MISC]
https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc [x_refsource_CONFIRM]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30154 [government-resource]
https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup [x_refsource_MISC]

Authoritative record: CVE-2025-30154 at cve.org

Vendors: reviewdog

Weaknesses: CWE-506

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-30154 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.