{"id":"CVE-2025-30154","kind":"vulnerability","aliases":["CVE-2025-30154"],"related":[],"title":"reviewdog/action-setup is a GitHub action that installs reviewdog","description":"reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.","summary":"The reviewdog/action-setup GitHub Action contains embedded malicious code that dumps secrets exposed to the workflow into GitHub Actions workflow logs. An attacker who can read those logs, or who gets a workflow to run this action, can obtain the secrets it printed.","severity":"high","cvss":8.6,"epss":null,"exploited":true,"exploited_at":"2025-03-24T00:00:00+00:00","products":[{"name":"reviewdog action-setup GitHub Action","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"reviewdog action-ast-grep","fixed":["1.26.2"],"affected":"< 1.26.2","ecosystem":"vendor"},{"name":"reviewdog action-composite-template","fixed":["0.20.2"],"affected":"< 0.20.2","ecosystem":"vendor"},{"name":"reviewdog action-setup","fixed":[],"affected":"= 1","ecosystem":"vendor"},{"name":"reviewdog action-shellcheck","fixed":["1.29.2"],"affected":"< 1.29.2","ecosystem":"vendor"},{"name":"reviewdog action-staticcheck","fixed":["1.26.2"],"affected":"< 1.26.2","ecosystem":"vendor"},{"name":"reviewdog action-typos","fixed":["1.17.2"],"affected":"< 1.17.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ci-cd","exploited","github-actions","other","reviewdog"],"not_affected_if":["does-not-use-reviewdog-action-setup"],"how_to_check":"Search workflow files for uses: reviewdog/action-setup and note the version pinned.","fix":"Remove or replace reviewdog/action-setup in workflows, and rotate any secrets that were available to workflows running it.\nApply the vendor mitigations referenced by CISA; the sources do not name a fixed version.","status":"open","published_at":"2025-03-19T16:15:33+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:56+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-23T20:48:56Z","model":"claude-haiku-5-5","output":{"fix":"Remove or replace reviewdog/action-setup in workflows, and rotate any secrets that were available to workflows running it.\nApply the vendor mitigations referenced by CISA; the sources do not name a fixed version.","reach":"internet","summary":"The reviewdog/action-setup GitHub Action contains embedded malicious code that dumps secrets exposed to the workflow into GitHub Actions workflow logs. An attacker who can read those logs, or who gets a workflow to run this action, can obtain the secrets it printed.","category":"other","who_cares":["github-actions","ci-cd","reviewdog"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Secrets available to the workflow are printed into readable CI logs.","analyst_note":"Find the vendor advisory and affected or fixed versions via the CISA KEV entry and the GitHub advisory for reviewdog/action-setup, and confirm the exact exposure window and remediation steps.","how_to_check":"Search workflow files for uses: reviewdog/action-setup and note the version pinned.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["does-not-use-reviewdog-action-setup"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":2578,"output_tokens":455,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':10A,13A '-30154':11A,14A '11':111C '18':114C '20':117C '2025':112C '31':118C '42':115C 'action':5A,17A,20A,23A,28A,33A,37A,41A,45A,53B,59B,73B,91B,102C,130C,135C 'action-ast-grep':22A 'action-composite-template':27A 'action-setup':16A,32A 'action-shellcheck':36A 'action-staticcheck':40A 'action-typos':44A 'add':123C 'also':142C 'ast':24A 'attack':77B 'cd':49B 'ci':48B 'ci-cd':47B 'code':63B,122C 'composite':29A 'compromis':109C,144C 'contain':60B 'cve':9A,12A 'dump':65B,125C 'embed':61B 'exploit':50B 'expos':67B,126C 'get':85B 'github':4A,19A,52B,58B,72B,101C,129C 'github-act':51B 'grep':25A 'instal':7A,104C 'log':75B,82B,132C 'malici':62B,121C 'march':110C 'method':150C 'obtain':93B 'pin':149C 'print':97B 'read':80B 'regardless':145C 'reviewdog':8A,15A,21A,26A,31A,35A,39A,43A,55B,105C,134C 'reviewdog/action-ast-grep':155C 'reviewdog/action-composite-template':153C 'reviewdog/action-setup':1A,57B,98C,106C,138C 'reviewdog/action-shellcheck':152C 'reviewdog/action-staticcheck':154C 'reviewdog/action-typos':157C 'run':89B 'secret':66B,95B,127C 'setup':18A,34A 'shellcheck':38A 'staticcheck':42A 'template':30A 'typos':46A 'use':137C 'utc':119C 'v1':107C,139C 'version':147C 'workflow':70B,74B,87B,131C 'would':141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-19T16:15:33+00:00","kev":{"dateAdded":"2025-03-24","dueDate":"2025-04-14","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-30154","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-30154","severity":null,"published_at":"2025-03-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-30154","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30154","severity":null,"published_at":"2025-03-19T16:15:33+00:00","modified_at":"2026-06-17T09:08:15+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}