Research · Mar 19, 2025
Malicious Code Vulnerability Discovered in reviewdog GitHub Actions
A significant vulnerability has been identified in the reviewdog GitHub Actions, allowing malicious code to expose sensitive secrets in workflow logs.
What changed
- The compromise occurred on March 11, 2025, between 18:42 and 20:31 UTC.
- Malicious code affects not only reviewdog/action-setup but also other related actions.
Who is affected
- Users of reviewdog/action-setup, which installs reviewdog.
- Developers utilizing reviewdog/action-shellcheck.
- Those employing reviewdog/action-composite-template and reviewdog/action-staticcheck.
- Any workflows that integrate these actions are vulnerable, regardless of version or pinning method.
What to do
- Audit your GitHub Actions for the use of compromised reviewdog actions.
- Consider removing or replacing affected actions until a fix is confirmed.
- Monitor for updates from the vendor regarding patches or mitigation strategies.