CVE-2025-30066

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2025-03-18. Federal remediation due 2025-04-08.

SSVC decision

• ExploitationactiveCISA reports credible evidence of active exploitation.
• AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

72.09% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.4% of scored records. A rank, not a probability.

NVD base score

8.6 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

NVD analysis status

Analyzed. NVD last modified this record on 2026-09-24.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2025-03-15 00:00Z1 YR AGO

Last updated

2026-02-26 19:09Z8 MO AGO

Reserved

2025-03-15

Assigning CNA

mitre

Record state

PUBLISHED

Severity

High (CVSS 8.6)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses

• CWE-506Embedded Malicious CodeClass

Data version

5.2

Document digest

6a0e52a61941909a09dd51d0e282221199347ce074382b9c48d252e614a8af46

• github.comhttps://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193
• github.comhttps://github.com/tj-actions/changed-files/issues/2463
• www.stepsecurity.iohttps://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
• semgrep.devhttps://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/
• news.ycombinator.comhttps://news.ycombinator.com/item?id=43368870
• web.archive.orghttps://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463
• news.ycombinator.comhttps://news.ycombinator.com/item?id=43367987
• github.comhttps://github.com/rackerlabs/genestack/pull/903
• github.comhttps://github.com/chains-project/maven-lockfile/pull/1111
• sysdig.comhttps://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/
• github.comhttps://github.com/espressif/arduino-esp32/issues/11127
• github.comhttps://github.com/modal-labs/modal-examples/issues/1100
• github.comhttps://github.com/tj-actions/changed-files/issues/2464
• github.comhttps://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28
• www.wiz.iohttps://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
• www.stream.securityhttps://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond
• www.sweet.securityhttps://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack
• github.comhttps://github.com/tj-actions/changed-files/issues/2477
• blog.gitguardian.comhttps://blog.gitguardian.com/compromised-tj-actions/
• www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30066government-resource
• www.cisa.govhttps://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066