CVE-2025-30154

Name of the Vulnerable Software and Affected Versions reviewdog/action-setup version v1 reviewdog/action-shellcheck (affected versions not specified) reviewdog/action-composite-template (affected versions not specified) reviewdog/action-staticcheck (affected versions not specified) reviewdog/action-ast-grep (affected versions not specified) reviewdog/action-typos (affected versions not specified)

Description reviewdog/action-setup is a GitHub action used to install reviewdog. A compromise occurred on March 11, 2025, between 18:42 and 20:31 UTC, during which malicious code was embedded to dump exposed secrets into GitHub Actions Workflow Logs. This issue also affects other reviewdog actions that rely on reviewdog/action-setup@v1, regardless of their version or pinning method. This issue has been exploited in the wild.

Recommendations For reviewdog/action-setup version v1, upgrade the action to a version that includes the fix via the retag update. For reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos, ensure they are not utilizing the compromised reviewdog/action-setup@v1 version.