CVE-2025-30154 — reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `review

01What is this vulnerability?

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are…

02Affected products

Vendor	Product	Versions
reviewdog	reviewdog	= 1

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2025-03-24. Ransomware use: Unknown.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2025-03-19T15:15:29.113Z
• Last modified: 2026-02-26T19:09:21.840Z
• Added to CISA KEV: 2025-03-24
• BOD 22-01 due: 2025-04-14

09References

• github.com — https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc
• github.com — https://github.com/reviewdog/reviewdog/issues/2079
• github.com — https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab7130573…
• github.com — https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e080…
• www.wiz.io — https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-s…