Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2025-30154: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

89
Patch now
HIGH 8.6EXPLOITEDREMOTEUPGRADEUPGRADEDOWNGRADE

CVE-2025-30154 is a high-severity flaw (CVSS 8.6) affecting action-ast-grep, action-composite-template, action-setup, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, review

Why this priority

  • High severity
  • Exploited in the wild (CISA KEV)
  • Public exploit reference
  • CISA SSVC: automatable with total technical impact
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score8.6 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance2.5% (top 15%)
CISA exploited listYes, fix due 2025-04-14
WeaknessCWE-506
Published2025-03-19
Last modified2026-06-17
Publisher (CNA): GitHub, Inc. · Vendor: reviewdog

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

reviewdog action-ast-grep UPGRADE
Affected: < 1.26.2
Fixed in: 1.26.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy action-ast-grep || rpm -q action-ast-grep || action-ast-grep --version
2. UPGRADE to 1.26.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade action-ast-grep
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade action-ast-grep
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
reviewdog action-composite-template UPGRADE
Affected: < 0.20.2
Fixed in: 0.20.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy action-composite-template || rpm -q action-composite-template || action-composite-template --version
2. UPGRADE to 0.20.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade action-composite-template
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade action-composite-template
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
reviewdog action-setup DOWNGRADE
Affected: 1
Fixed in: no fixed release known
Safe to downgrade to: a release before 1
1. Check installed version
apt-cache policy action-setup || rpm -q action-setup || action-setup --version
2. No fixed release: DOWNGRADE to a release before 1 (Debian / Ubuntu)
apt-cache madison action-setup sudo apt install action-setup=<VERSION_BEFORE_1> sudo apt-mark hold action-setup
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list action-setup sudo dnf downgrade action-setup-<VERSION_BEFORE_1> sudo dnf versionlock add action-setup
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
reviewdog action-shellcheck UPGRADE
Affected: < 1.29.2
Fixed in: 1.29.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy action-shellcheck || rpm -q action-shellcheck || action-shellcheck --version
2. UPGRADE to 1.29.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade action-shellcheck
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade action-shellcheck
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
reviewdog action-staticcheck UPGRADE
Affected: < 1.26.2
Fixed in: 1.26.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy action-staticcheck || rpm -q action-staticcheck || action-staticcheck --version
2. UPGRADE to 1.26.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade action-staticcheck
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade action-staticcheck
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
reviewdog action-typos UPGRADE
Affected: < 1.17.2
Fixed in: 1.17.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy action-typos || rpm -q action-typos || action-typos --version
2. UPGRADE to 1.17.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade action-typos
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade action-typos
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · perl-WWW-OrangeHRM-Client · FIXED · 0.12.0-21.fc46 · FEDORA-2026-2d14efca09 · source
sudo dnf upgrade --advisory=FEDORA-2026-2d14efca09

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-30154?

action-ast-grep: upgrade to 1.26.2; action-composite-template: upgrade to 0.20.2; action-setup: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2025-30154 being exploited?

Yes. CVE-2025-30154 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-30154 affect?

CVE-2025-30154 affects action-ast-grep, action-composite-template, action-setup. Severity is high (CVSS 8.6). reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs.

How urgent is CVE-2025-30154?

Priority 89/100. High severity; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

GitHub vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.