Join our Newsletter — 33% off our NHI Course

CVE-2025-30066 (tj-actions/changed-files GitHub Action Embedded Malicious Code)

CVE-2025-30066 is a tj-actions/changed-files embedded malicious code vulnerability in tj-actions changed-files GitHub Action. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 March 2025, which means attackers have used it in real attacks. tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs.

What Makes This CVE Dangerous in GitHub Actions

This vulnerability matters because the action runs inside software delivery pipelines, where workflow logs can contain sensitive material from build and deployment steps. When malicious code is embedded in a widely used action, the danger is not just code tampering, but secret exposure across many repositories at once.

That combination makes the issue a supply chain problem: a trusted automation component can be turned into a secret-discovery mechanism. In practice, that can expose tokens, API keys, and other credentials that were never meant to leave the CI/CD boundary.

How Exposure Happens and What Organisations Should Check

To assess exposure, organisations should first identify every workflow that uses the affected action, then determine whether those workflows log sensitive output or process secrets during execution. Inventory matters because this kind of issue is often inherited through shared templates, reusable workflows, and downstream repositories rather than only direct use.

They should also review whether the action was pinned to a trusted commit SHA or consumed through a mutable reference, since mutable dependencies expand the window for compromise. For authoritative version and patch details, readers should consult the CVE Program and the NIST National Vulnerability Database.

For CI/CD-specific hardening, NHI Management Group’s CI/CD Security Guide and CI/CD Pipeline Identity Security Guide cover the workflow controls that most directly reduce this class of exposure.

Remediation and Compensating Controls When You Cannot Patch Immediately

When immediate removal is not possible, the priority is to limit what the workflow can reveal and where those logs can be read. Reduce secret exposure by shrinking token scope, avoiding unnecessary secret injection, and isolating high-trust workflows from low-trust build paths.

Compensating controls should also assume that a log leak can become an identity compromise. Short-lived credentials, strict workflow permissions, protected branches, and pinned third-party actions all reduce the blast radius if an action or its dependency chain is poisoned.

Because this CVE sits in the software supply chain, the safest operational stance is to treat any unreviewed action update as a potential code-change event, not a routine maintenance task. NHI Management Group’s Vulnerability Management Guide is useful for prioritising the issue as an exploited weakness rather than a routine backlog item.

Detection, Investigation, and Secret Rotation After Possible Exposure

Detection should focus on whether workflow logs, run artefacts, or job outputs contain credentials, token fragments, or unusual echoing of environment values. If the action was used in a sensitive pipeline, review historical runs as well, because compromise may have occurred before the vulnerability was publicly recognised.

If there is any credible sign that secrets were exposed, rotate the affected tokens, keys, and service credentials immediately, then invalidate sessions and access paths that depended on them. The follow-up review should confirm whether the leaked material enabled further access, repository changes, or downstream cloud abuse.

The broader lesson from this incident is that CI/CD logs are part of the attack surface. NHI Management Group’s State of NHI & AI Agent Breach Report shows how often stolen secrets become the bridge from initial compromise to later movement and abuse.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and SLSA set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
MITRE ATT&CK T1552 — Unsecured Credentials This CVE exposes secrets through logs, a credential access pattern.
Recommendation — Map exposed log data to T1552 and hunt for credential theft across CI/CD telemetry.
CIS Controls v8 CIS-5 — Account Management Compromised workflow secrets and tokens require strong account and access hygiene.
Recommendation — Tighten account and token governance so pipeline secrets are short-lived and reviewable.
NIST SP 800-53 Rev 5 AU-9 — Protection of Audit Information Workflow logs can disclose secrets, so log protection is materially central here.
IA-5 — Authenticator Management Secret rotation and lifecycle control are central when credentials may have been exposed.
Recommendation — Protect build and workflow logs so they do not disclose sensitive credentials or tokens. Rotate and manage authenticators promptly after any suspected workflow secret exposure.
SLSA Supply chain integrity The issue is a poisoned action in the software supply chain.
Recommendation — Treat third-party actions as supply-chain dependencies and require pinned provenance.