VulnRadar

Data against noise.

Page generated: 11 Nov 2026, 03:17 UTC

CVE-2025-30154

Read full description

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.

CVSS 8.6 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.3/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.6: +1.29
Fresh EPSS: 2.48%: +0.01

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 8 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

EclecticIQ Blog

Press · 17 Aug 2026, 07:00 · Compromising the Developer: How Modern Dependency Culture Reshaped the Supply Chain Threat Landscape - EclecticIQ Blog

CloudSEK

Press · 19 Mar 2026, 07:00 · The Scanner Was the Weapon: 36 Months of Precision Supply Chain Attacks Against DevSecOps Infrastructure - CloudSEK

Endor Labs

Press · 25 Mar 2025, 07:00 · OWASP OSS Risk 2: Compromise of Legitimate Package - Endor Labs

The Hacker News

Press · 23 Mar 2025, 07:00 · Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed - The Hacker News

SecurityWeek

Press · 21 Mar 2025, 07:00 · Impact, Root Cause of GitHub Actions Supply Chain Hack Revealed - SecurityWeek

See all 8 source documents

Cybersecurity Dive

Press · 21 Mar 2025, 07:00 · Coinbase originally targeted during GitHub Action supply chain attack - Cybersecurity Dive

Cybersecurity Dive

Press · 20 Mar 2025, 07:00 · GitHub Action compromise linked to previously undisclosed attack - Cybersecurity Dive

wiz.io

Press · 17 Mar 2025, 07:00 · New GitHub Action supply chain attack: reviewdog/action-setup - wiz.io

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.3 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.6; EPSS 2.5%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:32.825259+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

17 Mar 2025, 07:00

Published

19 Mar 2025, 15:15

Added to the CISA KEV catalog

24 Mar 2025, 00:00

Latest press mention

17 Aug 2026, 07:00

Score calculated

05 Nov 2026, 13:59