CVE-2025-30066: tj-actions/changed-files fixed in 46.0.1

CVE-2025-30066 PUBLISHED CVSS 8.6 HIGH

Reported by mitre · Published March 15, 2025

tj-actions/changed-files is fixed in 46.0.1 (GitHub Packages)

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
tj-actions/changed-files	GitHub Packages	46.0.1
changed-files	tj-actions	46, 45.0.7

Risk scores

CVSS 3.1

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

Vendor	Product	Versions
tj-actions	changed-files	1
tj-actions	changed-files	1

Timeline

Mar 15, 2025 CVE Published
Mar 15, 2025 VulnCheck KEV Exploitation (4 in total, the first dated here)
Mar 15, 2025 PoC Published (81 in total, the first dated here)
Mar 16, 2025 EPSS Score (30 in total, the first dated here)
Mar 18, 2025 CISA KEV Added
Feb 26, 2026 CVE Updated
Apr 2, 2026 Security Advisory
Jun 14, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-30066
vulnetix vdb fixes CVE-2025-30066

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-30066/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066 advisory

…and 1 more

Look up in the Resolve Platform →