CVE-2025-30066Vulnerability
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 5 months ago
CISA KEVAdded 18 Mar 2025
Fix due 8 Apr 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 8 Apr 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS72.1%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
CI/CD pipeline abuse: the problem no one is watching“SHA-pinned references prevent retroactive tag modification attacks like tj-actions (CVE-2025-30066).”
Indicators reported together
named in the same reports- cicd[.]actorin 1 report
- hxxps://github[.]com/elastic/cicd-abuse-detectorin 1 report
- hxxps://github[.]com/synacktiv/nord-streamin 1 report
- hxxps://github[.]com/AdnaneKhan/Gato-Xin 1 report
- hxxps://blog.gitguardian[.]com/ghostaction-campaign-3-325-secrets-stolenin 1 report
- blog.gitguardian[.]comin 1 report
- hxxps://www.reversinglabs[.]com/blog/shai-hulud-worm-npmin 1 report
- hxxps://orca[.]security/resources/blog/pull-request-nightmare-github-actions-rce/in 1 report
- orca[.]securityin 1 report
- hxxps://orca[.]security/resources/blog/hackerbot-claw-github-actions-attack/in 1 report
- hxxps://www.stepsecurity[.]io/blog/hackerbot-claw-github-actions-exploitationin 1 report
- www.stepsecurity[.]ioin 1 report
- hxxps://www.legitsecurity[.]com/blog/github-privilege-escalation-vulnerability-0in 1 report
- www.legitsecurity[.]comin 1 report
- hxxps://www.abstract[.]security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vectorin 1 report
- www.abstract[.]securityin 1 report
- hxxps://about.codecov[.]io/apr-2021-post-mortem/in 1 report
- about.codecov[.]ioin 1 report
- hxxps://kl4r10n[.]tech/blog/when-git-history-liesin 1 report
- kl4r10n[.]techin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.