CVE-2025-30154

Known Exploited Vulnerability

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

Vendor / product: reviewdog / action-setup GitHub Action

Description

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

Weakness classification

• security-advisories@github.com: CWE-506
• nvd@nist.gov: NVD-CWE-Other

Primary references

• security-advisories@github.com — Patch
• security-advisories@github.com — Patch
• security-advisories@github.com — Issue Tracking, Vendor Advisory
• security-advisories@github.com — Vendor Advisory
• security-advisories@github.com — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource