Advisory: GitHub Action tj-actions/changed-files Compromise (CVE-2025-30066)

Overview

On 14 March 2025, a security issue was reported in the tj-actions/changed-files GitHub Action, which identified that the Action’s code had been compromised by an external attacker.

The compromised code allowed the attacker to log CI/CD credentials from the Runner Worker process into the GitHub build logs. This could potentially lead to the exfiltration of sensitive credentials, particularly if the repository was public or if the attacker had access to the build logs.

Sophos has investigated the potential impact of the compromised Github Action and has found no evidence that any Sophos repositories or products were affected.

Related information

• https://github.com/tj-actions/changed-files/issues/2463
• https://www.cve.org/CVERecord?id=CVE-2025-30066