Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2025-03-24 — agencies required to remediate by 2025-04-14
📦 GitHub Actions

GHSA-qmg3-hpqr-gqvc

HIGH

Multiple Reviewdog actions were compromised during a specific time period

Also known asCVE-2025-30154
Published
Mar 19, 2025
Updated
Oct 22, 2025
Affected
1 pkg
Patched
None yet
Exploits
None indexed

EPSS Exploitation Probability

via FIRST.org ↗
37.1%probability of exploitation in next 30 days
Moderate Risk97th percentile+2.52%
8.89%20.5%32.0%43.6%17.9%37.1%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected
📦reviewdog/action-setup

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages — download data is not available via public APIs for these ecosystems.

Description

Summary

reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs.

Other reviewdog actions that use reviewdog/action-setup@v1 would also be compromised, regardless of version or pinning method:

  • reviewdog/action-shellcheck
  • reviewdog/action-composite-template
  • reviewdog/action-staticcheck
  • reviewdog/action-ast-grep
  • reviewdog/action-typos

Details

Malicious commit: https://github.com/reviewdog/action-setup/commit/f0d342d fix/retag via version upgrade: https://github.com/reviewdog/action-setup/commit/3f401fe

See the detailed report from Wiz Research: Wiz Blog Post and reviewdog maintainer annoucement: reviewdog #2079

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
📦GitHub Actionsreviewdog/action-setupall versionsNo fix

Frequently Asked Questions

### Summary `reviewdog/action-setup@v1` was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` would also be compromised, regardless of version or pinning method: - reviewdog/action-shellcheck - reviewdog/action-composite-template - reviewdog/action-staticcheck - reviewdog/action-ast-grep - reviewdog/action-typos ### Details Malicious commit: https://github.com/reviewdog/action-setup/commit/f0d342d fix/retag via version upgrade: https://gi
O3 Security · Impact-Aware SCA

Is GHSA-qmg3-hpqr-gqvc in your stack?

O3 detects GHSA-qmg3-hpqr-gqvc across GitHub Actions dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works