Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

arduino-esp32 is using a compromised tj-actions/changed-files GitHub action (CVE-2025-30066) #11127

Closed
eslerm opened this issue Mar 15, 2025 · 3 comments · Fixed by #11130
Closed

Comments

@eslerm
Copy link

eslerm commented Mar 15, 2025

arduino-esp32 uses a compromised version of tj-actions/changed-files. The compromised action appears to leak secrets the runner has in memory.

The action is included in:

Output of an affected run:

Please review.

Learn about the compromise on StepSecurity of Semgrep.

This issue has been assigned CVE-2025-30066

@eslerm eslerm added the Status: Awaiting triage Issue is waiting for triage label Mar 15, 2025
@eslerm
Copy link
Author

eslerm commented Mar 15, 2025

Note that https://github.com/espressif/pytest-embedded also uses this action.

@me-no-dev
Copy link
Member

@eslerm thanks! we are aware and actions are currently disabled

@Jason2866 Jason2866 added Status: In Progress ⚠️ Issue is in progress Type: CI & Testing and removed Status: Awaiting triage Issue is waiting for triage labels Mar 16, 2025
@Jason2866
Copy link
Collaborator

Fixed by #11130

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants