https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:22:15.714747+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-03223 bdu:2025-03223 2026-10-03T11:22:15.784068+00:00 bdu:2025-03223 https://cve.radiocsirt.org/vuln/euvd-2026-273395 EUVD-2026-273395 2026-10-03T11:22:15.784110+00:00 EUVD-2026-273395 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30154 fkie_cve-2025-30154 2026-10-03T11:22:15.784125+00:00

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

 https://cve.radiocsirt.org/vuln/ghsa-qmg3-hpqr-gqvc GHSA-qmg3-hpqr-gqvc — Multiple Reviewdog actions were compromised during a specific time period 2026-10-03T11:22:15.784159+00:00

Affected: GitHub Actions: reviewdog/action-setup

### Summary

`reviewdog/action-setup@v1` was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs.

Other reviewdog actions that use `reviewdog/action-setup@v1` would also be compromised, regardless of version or pinning method: - reviewdog/action-shellcheck - reviewdog/action-composite-template - reviewdog/action-staticcheck - reviewdog/action-ast-grep - reviewdog/action-typos

### Details

Malicious commit: https://github.com/reviewdog/action-setup/commit/f0d342d fix/retag via version upgrade: https://github.com/reviewdog/action-setup/commit/3f401fe

See the detailed report from Wiz Research: [Wiz Blog Post](https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup) and reviewdog maintainer annoucement: [reviewdog #2079](https://github.com/reviewdog/reviewdog/issues/2079)