CVE-2025-30154
Description
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
How to fix
Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: Apr 14, 2025- reviewdog action-ast-grep1.26.2 or later
- reviewdog action-composite-template0.20.2 or later
- reviewdog action-shellcheck1.29.2 or later
- reviewdog action-staticcheck1.26.2 or later
- reviewdog action-typos1.17.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| reviewdog action-ast-grep | v < 1.26.2 | 1.26.2 |
| reviewdog action-composite-template | v < 0.20.2 | 0.20.2 |
| reviewdog action-setup | 1 | — |
| reviewdog action-shellcheck | v < 1.29.2 | 1.29.2 |
| reviewdog action-staticcheck | v < 1.26.2 | 1.26.2 |
| reviewdog action-typos | v < 1.17.2 | 1.17.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.