CVE-2025-30154
Description
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Summary dbcve.org
reviewdog/action-setup@v1 was compromised with malicious code that exfiltrates exposed secrets to GitHub Actions Workflow Logs. Any workflow using this action or its downstream dependents (action-shellcheck, action-composite-template, action-staticcheck, action-ast-grep, action-typos) during the compromise window (March 11, 2025 18:42-20:31 UTC) had secrets potentially logged and accessible to the attacker.
Mitigation
Immediately audit all workflows using the affected actions, rotate any secrets that may have been exposed, update to a safe version or remove the compromised action, and review workflow logs for unauthorized access.