Embedded Malicious Code in tj‑actions/changed‑files GitHub Action (CVE‑2025‑30066) Risks Secret Leakage
What It Is – The tj-actions/changed-files GitHub Action contains hidden malicious code that can read the workflow’s runtime logs. By parsing those logs, an attacker can harvest secrets such as AWS keys, GitHub PATs, npm tokens, and private RSA keys.
Exploitability – The vulnerability is exploitable by any remote actor who can trigger the compromised Action in a repository’s CI/CD pipeline. Public proof‑of‑concept code is available, and the CVSS score is rated 7.8 (High).
Affected Products – tj-actions/changed-files GitHub Action (published on the GitHub Marketplace). Any GitHub repository that incorporates this Action is potentially vulnerable.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of third‑party components in the software supply chain; evidence of vetting and runtime verification is a core trust signal.
- Highlights gaps in secret‑management controls: without strict segregation of duties and audit‑ready logging, leaked credentials undermine compliance readiness.
- Provides a concrete example of why enterprises must maintain defensible evidence of vendor oversight to satisfy multiple frameworks (e.g., NIST CSF 2.0 governance and risk controls).
Recommended Actions
- Immediately remove the
tj-actions/changed-filesAction from all pipelines and replace it with a vetted alternative. - Conduct a secret‑rotation sweep for any credentials that may have been exposed (AWS keys, PATs, npm tokens, RSA keys).
- Enable immutable logging for GitHub Actions and integrate those logs into a SIEM for continuous monitoring.
- Adopt a third‑party risk management process that captures evidence of code‑review, provenance, and runtime behavior for all CI/CD components.
Source: CISA KEV – CVE‑2025‑30066