Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-30145
CVE-2025-30145:
Java vulnerability analysis and mitigation
Overview
The reviewdog/action-setup GitHub action (v1) was compromised on March 11, 2025, between 18:42 and 20:31 UTC. The compromise involved malicious code that was designed to dump exposed secrets to Github Actions Workflow Logs. This vulnerability affected multiple reviewdog actions that depend on reviewdog/action-setup@v1, including reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos (NVD).
Technical details
The vulnerability has been assigned a CVSS v3.1 base score of 8.6 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. The vulnerability is classified as CWE-506 (Embedded Malicious Code). The attack requires no user interaction or privileges and can be executed remotely (NVD).
Impact
The primary impact of this vulnerability is the potential exposure of sensitive information, as the malicious code was specifically designed to extract secrets from GitHub Actions workflows and dump them to workflow logs. This could lead to the compromise of sensitive credentials and tokens used in CI/CD pipelines (NVD).
Mitigation and workarounds
Organizations using affected reviewdog actions should immediately update to the patched versions: action-ast-grep v1.26.2, action-composite-template v0.20.2, action-shellcheck v1.29.2, and action-staticcheck v1.26.2. CISA has set a due date of April 14, 2025, for federal agencies to apply the required mitigations (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management