Live › vulnerability › CVE-2025-30154
Go to dashboardThe reviewdog/action-setup GitHub Action contains embedded malicious code that dumps secrets exposed to the workflow into GitHub Actions workflow logs. An attacker who can read those logs, or who gets a workflow to run this action, can obtain the secrets it printed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| reviewdog action-setup GitHub Action | vendor | – | – |
| reviewdog action-ast-grep | vendor | < 1.26.2 | 1.26.2 |
| reviewdog action-composite-template | vendor | < 0.20.2 | 0.20.2 |
| reviewdog action-setup | vendor | = 1 | – |
| reviewdog action-shellcheck | vendor | < 1.29.2 | 1.29.2 |
| reviewdog action-staticcheck | vendor | < 1.26.2 | 1.26.2 |
| reviewdog action-typos | vendor | < 1.17.2 | 1.17.2 |
Search workflow files for uses: reviewdog/action-setup and note the version pinned.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v1 that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
This page as .md · .json · in your agent: get_signal("CVE-2025-30154")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.