CVE-2025-30066
NVD has not published a description yet.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
CISA says: Apply mitigations as set forth in the CISA instructions linked below. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Show me how to fix itTimeline
- Added to CISA known exploited list
- First covered by RedTeamDaily
Coverage
Guide urges pinning GitHub Actions to commit SHAs to block supply chain attacks
The article is part one of a series on hardening GitHub Actions against outside attackers. It explains that version tags such as @v4 are movable pointers, and cites the March 2025 tj-actions/changed-files compromise, where repointed tags exposed credentials in public build logs. It recommends pinning actions to full 40-character commit SHAs, enforcing this with zizmor and an organisation policy, and warns that a SHA proves immutability but not provenance.
Sources: NVD and CISA known exploited vulnerabilities catalogue.