Secret Exfiltration in reviewdog/action-setup GitHub Action

Historical catalog analysis: CISA added this entry on March 24, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-30154 describes a supply chain compromise involving the reviewdog/action-setup GitHub Action. The vulnerability consists of embedded malicious code (CWE-506) designed to exfiltrate sensitive data by dumping exposed secrets directly into GitHub Actions Workflow Logs.

Exposure and applicability

This vulnerability affects organizations utilizing the reviewdog/action-setup action within their CI/CD pipelines. The primary exposure path is the execution of the compromised action in a workflow environment where secrets are available to the runner. Because this is an open-source project used across various environments, any pipeline integrating this specific GitHub Action is potentially applicable.

Potential breach-prevention strategy

The reported failure is the inclusion of malicious code within a third-party dependency that allows secrets to be written to logs. It remains unknown exactly how the malicious code was introduced into the action or if it targeted specific organizations.

Our analysis suggests the following prioritized actions to reduce the likelihood of similar occurrences:

1. Pin Actions to Specific Commit SHAs: Rather than using mutable tags (e.g., @v1), pinning to a full SHA ensures that the code being executed is immutable and has been vetted. This addresses the scenario where a trusted tag is updated with malicious code. Responsible Role: DevOps/Platform Engineer. Verification: Audit workflow YAML files for commit hashes.
2. Implement Secret Masking and Log Auditing: While GitHub masks secrets, this vulnerability specifically targets the logs. Implementing automated scanning of workflow logs for patterns resembling secrets could reduce the window of exposure. This is a detection control to limit damage after initial compromise. Responsible Role: Security Operations (SecOps). Verification: Trigger a test workflow with a dummy secret and verify if log monitors alert on its presence.
3. Restrict Secret Scope: Applying the principle of least privilege by limiting which secrets are passed to specific actions could reduce the volume of data available for exfiltration. This limits damage from an initial compromise. Responsible Role: IAM/Security Architect. Verification: Review GitHub Action environment secret permissions.

Remediation priorities

Defenders should prioritize the following based on CISA and vendor guidance:
* Immediate Identification: Audit all repositories and CI/CD pipelines to identify where reviewdog/action-setup is currently deployed.
* Apply Mitigations: Implement corrective actions as specified by the vendor or CISA. This may include updating to a patched version or applying specific configuration changes.
* Discontinuation: If verified mitigations are unavailable or cannot be validated, the product should be discontinued in favor of a secure alternative.

How to validate remediation

Verification must go beyond a simple version check. To prove exposure was reduced, defenders should:
1. Verify Code Integrity: Confirm that the action is pinned to a known-safe commit SHA or a version explicitly cleared by the vendor.
2. Inspect Workflow Logs: Review historical GitHub Actions Workflow Logs for evidence of secret dumping to determine if exfiltration occurred prior to remediation.
3. Configuration Audit: Validate that secrets are no longer being passed to the affected action unless necessary and that those secrets have been rotated.

Limits and open questions

Updating the action or pinning a SHA does not guarantee that previously exfiltrated secrets are secure; any secret exposed in logs must be considered compromised and rotated. It remains unclear if other versions of the action or related tools share this vulnerability. There is residual risk associated with the use of third-party actions where the internal code may change without notice unless strict pinning is enforced.

Source and editorial note

CVE-2025-30154: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability · Source date: March 24, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 27, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 21, 2026 at 00:05 UTC.

Request a Vulnerability Assessment