{"metadata": {"vulnerability": "ghsa-qmg3-hpqr-gqvc", "count": 16, "kinds": {"milestone": 3, "sighting": 5, "kev": 0, "other": 8}}, "data": [{"timestamp": "2025-03-17T12:41:42.566Z", "date_only": false, "value": "2025-03-17T12:41:42.566Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2025-30154", "record": "CVE-2025-30154", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-19T15:15:29.113Z", "date_only": false, "value": "2025-03-19T15:15:29.113Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2025-30154", "record": "CVE-2025-30154", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-03-19T15:15:29.113Z", "date_only": false, "value": "2025-03-19T15:15:29.113Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-30154 / GitHub_M", "record": "CVE-2025-30154", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-19T15:19:12Z", "date_only": false, "value": "2025-03-19T15:19:12Z", "kind": "milestone", "label": "Published", "source": "github", "record": "ghsa-qmg3-hpqr-gqvc", "field": "published"}, {"timestamp": "2025-03-19T15:45:35.284Z", "date_only": false, "value": "2025-03-19T15:45:35.284319Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114189869676629359", "record": "GHSA-qmg3-hpqr-gqvc", "field": "creation_timestamp", "uuid": "04190e4c-efb4-49b7-a810-198dab2b8f31", "url": "https://infosec.exchange/users/cR0w/statuses/114189869676629359"}, {"timestamp": "2025-03-19T16:15:33Z", "date_only": false, "value": "2025-03-19T16:15:33Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "ghsa-qmg3-hpqr-gqvc", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-03-19T16:30:54Z", "date_only": false, "value": "2025-03-19T16:30:54.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1nxUJd1r2Vl_i3BcLbYFmcRkQRAx1kOCE3f---QAF-WqkIU", "record": "GHSA-QMG3-HPQR-GQVC", "field": "creation_timestamp", "uuid": "d678d8b9-fd12-4a02-b949-36e10c35c449"}, {"timestamp": "2025-03-19T17:21:01Z", "date_only": false, "value": "2025-03-19T17:21:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8098", "record": "GHSA-QMG3-HPQR-GQVC", "field": "creation_timestamp", "uuid": "2e575005-c304-468f-93a4-dc32dda1bc34", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30154\n\ud83d\udd25 CVSS Score: 8.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)\n\ud83d\udd39 Description: reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.\n\ud83d\udccf Published: 2025-03-19T15:15:29.113Z\n\ud83d\udccf Modified: 2025-03-19T16:21:02.390Z\n\ud83d\udd17 References:\n1. https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc\n2. https://github.com/reviewdog/reviewdog/issues/2079\n3. https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887\n4. https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec\n5. https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "url": "https://t.me/DarkWebInformer_CVEAlerts/8098"}, {"timestamp": "2025-03-22T09:39:39.610Z", "date_only": false, "value": "2025-03-22T09:39:39.610898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/azu.bsky.social/post/3lkxgn7bm5s26", "record": "GHSA-qmg3-hpqr-gqvc", "field": "creation_timestamp", "uuid": "28ca0dcd-1c75-4e32-9a5d-0d4538759e3a", "url": "https://bsky.app/profile/azu.bsky.social/post/3lkxgn7bm5s26"}, {"timestamp": "2025-03-24T00:00:00Z", "date_only": true, "value": "2025-03-24", "kind": "other", "label": "Catalog added", "source": "cvelistv5 \u00b7 CVE-2025-30154 / CISA-ADP", "record": "CVE-2025-30154", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2025-03-24T00:00:00Z", "date_only": false, "value": "2025-03-24T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 \u00b7 CVE-2025-30154 / CISA-ADP", "record": "CVE-2025-30154", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2025-03-24T23:23:29Z", "date_only": false, "value": "2025-03-24T23:23:29.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8569", "record": "GHSA-QMG3-HPQR-GQVC", "field": "creation_timestamp", "uuid": "7b2a792f-8564-4e71-a782-a3209c7f18ab", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30154\n\ud83d\udd25 CVSS Score: 8.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)\n\ud83d\udd39 Description: reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.\n\ud83d\udccf Published: 2025-03-19T15:15:29.113Z\n\ud83d\udccf Modified: 2025-03-24T22:20:22.752Z\n\ud83d\udd17 References:\n1. https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc\n2. https://github.com/reviewdog/reviewdog/issues/2079\n3. https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887\n4. https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec\n5. https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "url": "https://t.me/DarkWebInformer_CVEAlerts/8569"}, {"timestamp": "2025-03-25T03:55:16.734Z", "date_only": false, "value": "2025-03-25T03:55:16.734240Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2025-30154 / CISA-ADP", "record": "CVE-2025-30154", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-10-22T19:29:23Z", "date_only": false, "value": "2025-10-22T19:29:23Z", "kind": "other", "label": "Updated", "source": "github", "record": "ghsa-qmg3-hpqr-gqvc", "field": "modified"}, {"timestamp": "2026-02-26T19:09:21.840Z", "date_only": false, "value": "2026-02-26T19:09:21.840Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-30154", "record": "CVE-2025-30154", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-02-26T19:09:21.840Z", "date_only": false, "value": "2026-02-26T19:09:21.840Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-30154 / CISA-ADP", "record": "CVE-2025-30154", "field": "containers.adp.0.providerMetadata.dateUpdated"}]}