{"uuid": "2e575005-c304-468f-93a4-dc32dda1bc34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-QMG3-HPQR-GQVC", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8098", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-30154\n\ud83d\udd25 CVSS Score: 8.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)\n\ud83d\udd39 Description: reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.\n\ud83d\udccf Published: 2025-03-19T15:15:29.113Z\n\ud83d\udccf Modified: 2025-03-19T16:21:02.390Z\n\ud83d\udd17 References:\n1. https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc\n2. https://github.com/reviewdog/reviewdog/issues/2079\n3. https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887\n4. https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec\n5. https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup", "creation_timestamp": "2025-03-19T17:21:01.000000Z"}