https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:30:03 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00066 bdu:2026-00066 https://cve.radiocsirt.org/vuln/bdu:2026-00066 https://cve.radiocsirt.org/vuln/euvd-2026-273425 EUVD-2026-273425 https://cve.radiocsirt.org/vuln/euvd-2026-273425 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30066 <p>tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)</p> <p>tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-30066 https://cve.radiocsirt.org/vuln/ghsa-mrrh-fwg8-r2c3 <p><strong>Affected:</strong> GitHub Actions: tj-actions/changed-files</p> <p>### Summary A supply chain attack compromised the **tj-actions/changed-files** GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between **March 14 and March 15, 2025**, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.</p> <p>This has been patched in [v46.0.1](https://github.com/tj-actions/changed-files/releases/tag/v46.0.1).</p> <p>### Details The attack involved modifying the **tj-actions/changed-files** GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.</p> <p>#### Key Indicators of Compromise (IoC): - **Malicious commit**: [0e58ed8671d6b60d0890c21b07f8835ace038e67](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67) - **Retroactively updated tags pointing to the malicious commit**: - `v1.0.0`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - `v35.7.7-sec`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - `v44.5.1`: 0e58ed8671d6b60d0890c21b07f8835ace038e67</p> <p>#### Malicious Code Execution: The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs: ``` B…</p> <p><strong>Affected:</strong> GitHub Actions: tj-actions/changed-files</p> <p>### Summary A supply chain attack compromised the **tj-actions/changed-files** GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between **March 14 and March 15, 2025**, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.</p> <p>This has been patched in [v46.0.1](https://github.com/tj-actions/changed-files/releases/tag/v46.0.1).</p> <p>### Details The attack involved modifying the **tj-actions/changed-files** GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.</p> <p>#### Key Indicators of Compromise (IoC): - **Malicious commit**: [0e58ed8671d6b60d0890c21b07f8835ace038e67](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67) - **Retroactively updated tags pointing to the malicious commit**: - `v1.0.0`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - `v35.7.7-sec`: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - `v44.5.1`: 0e58ed8671d6b60d0890c21b07f8835ace038e67</p> <p>#### Malicious Code Execution: The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs: ``` B…</p> https://cve.radiocsirt.org/vuln/ghsa-mrrh-fwg8-r2c3