vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-30154

Multiple Reviewdog actions were compromised during a specific time period

HIGH
8.6
CVSS Score
Published: March 19, 2025 at 03:15 PM UTC
Updated: June 17, 2026 at 09:08 AM UTC
7 products affected across 1 vendorAction ShellcheckAction Composite TemplateAction Typos

Using reviewdog by reviewdog?

Get instant alerts when new vulnerabilities affect reviewdog - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.6
Exploitation
CISA KEV
Exploit prediction
EPSS 2%
SSVC
Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score2.5%

EPSS (Exploit Prediction Scoring System) estimates a 2.5% chance this CVE is exploited in the wild within the next 30 days — higher than 85% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

Required Action
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware Use
Unknown
Added to KEV
Mar 24, 2025
Remediation Due
Apr 14, 2025
564 days overdue
Notes
This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction
Additional References: https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc
https://nvd.nist.gov/vuln/detail/CVE-2025-30154

Description

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Action Ast Grep· Reviewdog
95%
v < 1.26.2
Affected range stops below 1.26.2, so it looks safe — our inference, not a vendor statement
Action Composite Template· Reviewdog
95%
v < 0.20.2
Affected range stops below 0.20.2, so it looks safe — our inference, not a vendor statement
Action Setup· Reviewdog
95%
1
Action Shellcheck· Reviewdog
95%
v < 1.29.2
Affected range stops below 1.29.2, so it looks safe — our inference, not a vendor statement
Action Staticcheck· Reviewdog
95%
v < 1.26.2
Affected range stops below 1.26.2, so it looks safe — our inference, not a vendor statement
Action Typos· Reviewdog
95%
v < 1.17.2
Affected range stops below 1.17.2, so it looks safe — our inference, not a vendor statement
Reviewdog· Reviewdog
60%
= 1

References (6)

x_refsource_MISCPatch
Source: [email protected]
https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887
x_refsource_MISCPatch
Source: [email protected]
https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec
x_refsource_MISCIssue TrackingVendor Advisory
Source: [email protected]
https://github.com/reviewdog/reviewdog/issues/2079
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
US Government Resource
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30154

SSVC — Action Prioritization

SSVCActiveAutomatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.6HIGHGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-506NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card