Vulnerability · CVE-2025-30154

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

Published Mar 19, 2025 · corrected/updated Jun 17, 2026 · reviewdog action-setup GitHub Action · evidence confidence very high

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2025-30154 is a high public vulnerability record for reviewdog action-setup GitHub Action. CISA lists it as known exploited. Published remediation guidance: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether reviewdog action-setup GitHub Action is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: reviewdog/action-ast-grep; reviewdog/action-composite-template; reviewdog/action-setup (1); reviewdog/action-shellcheck. Published remediation guidance: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 8.6, EPSS 2.5%. CISA lists it as known exploited. Weakness classes: CWE-506. Sources contributing to this record: cisa_kev, cve_org, epss, nvd. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Confirmed in CISA KEV since Mar 24, 2025. Listed in CISA KEV and VulnCheck KEV.
Patch and remediation
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA due date Apr 14, 2025.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Mar 19, 2025 · Catalog
Detected
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-comp
Mar 24, 2025 · CISA KEV
Known exploited
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Apr 14, 2025 · CISA KEV
Remediation due
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-comp

Affected

cpe reviewdog/action-ast-grepversion unspecified
cpe reviewdog/action-composite-templateversion unspecified
cpe reviewdog/action-setup1
cpe reviewdog/action-shellcheckversion unspecified
cpe reviewdog/action-staticcheckversion unspecified
cpe reviewdog/action-typosversion unspecified
vendor reviewdog action-setup GitHub Actionversion unspecified

Sources

CISA KEVConfirmed exploitationCVE-2025-30154
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
cisa.gov
CVE.orgVulnerability recordCVE-2025-30154
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2025-30154
30-day exploitation probability 2.5%
first.org
NIST NVDVulnerability recordCVE-2025-30154
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `review
nvd.nist.gov
VulnCheck KEVConfirmed exploitationCVE-2025-30154
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
vulncheck.com