Summary
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.
- Vendor
- tj-actions
- Product
- changed-files GitHub Action
- Added to KEV
- Mar 18, 2025
- Remediation due
- Apr 8, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-506
- EPSS
- 72.1% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References