CISA Highlights Active Threat in GitHub Action Supply Chain Disruption: Tips to Safeguard Your Data

attacker to take over control of a company’s systems and assets.

GitHub Action Vulnerability: An Overview

Every time a new code push is triggered in a repository, the GitHub Action entitled tj-actions/changed-files runs to determine the files that have changed between commits.

The serious flaw in this GitHub action, identified as CVE-2025-30066, allows attackers to inject malicious scripts into the file paths.

This, in turn, opens up the possibility for Remote Code Execution (RCE) when the files are executed without sanitization by subsequent GitHub actions.

The Exploitation in Action

Cybersecurity experts have identified a prevalent exploit script that sends system data to a remote attacker’s server by executing a shell command through RCE.

The attacker then uses this information to further infiltrate the system, often targeting valuable data or even entire infrastructural control.

Several instance of this exploitation have been reported, notably an attack on a large software company during the second week of January.

This has triggered the red flags at CISA, prompting the vulnerability to be added to its Known Exploited Vulnerabilities (KEV) list.

Best Practices for Mitigation

Until a permanent patch is released, CISA has recommended a workaround.

Users are advised to conduct regular audits of their GitHub Action runners and implement stricter input validation and sanitization to stop the exploit in its tracks.

Experts have also recommended refraining from using actions that run on unverified third-party forks, and utilizing a trustworthy alternative instead.

Looking Forward

With the rising prevalence of supply chain attacks, such as the SolarWinds and Kaseya incidents, cybersecurity practices need a revamp.

More robust mechanisms for detection, prevention, and mitigation are required at all levels.

This exploit should serve as a wake-up call for organizations to rethink and enhance their security policies and strategies, particularly around software pipelines.

Follow-Up Reading

• 1. CISA’s Known Exploited Vulnerabilities Catalog
• 2. Securely Manage Secrets in GitHub Actions – GitHub Blog
• 3. Supply Chain Security Guidance for Organisations – NCSC

For more news and updates on cyber threats, stay tuned on our platform.