CVE‑2025‑30154: reviewdog action‑setup GitHub Action Embedded Malicious Code Dumps Secrets to Workflow Logs
What It Is – The reviewdog/action-setup GitHub Action contains deliberately inserted malicious code that writes any exposed secrets (e.g., API keys, tokens) to the GitHub Actions workflow log. The vulnerability is tracked as CVE‑2025‑30154 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability – The malicious payload is executed whenever the compromised Action runs in a workflow that has access to repository secrets. Public proof‑of‑concept code is available, and the CVSS vector rates the flaw as High (≥7.0) due to the ease of trigger and the confidentiality impact.
Affected Products – reviewdog/action-setup GitHub Action (published by reviewdog).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous control mapping of third‑party CI/CD components against a unified control framework (VCF).
- Highlights gaps in secrets‑management controls: without proper masking and monitoring, secret leakage can become audit evidence of non‑compliance.
- Signals that supply‑chain assurance programs must capture evidence of secure configuration and log integrity for each external Action used in pipelines.
Recommended Actions
- Inventory all GitHub Actions in your repositories and cross‑reference them against a vetted control‑mapping catalog.
- Immediately upgrade to the patched version of
reviewdog/action-setup(or replace it with an internally reviewed alternative). - Enable GitHub’s secret‑masking feature and enforce “no‑write‑to‑logs” policies for any step that accesses secrets.
- Implement continuous monitoring of workflow logs for unexpected secret exposure events and retain logs as immutable audit evidence.
- Document the remediation steps in your control‑assurance repository to demonstrate due‑diligence during audits.
Source: CISA KEV – CVE‑2025‑30154