reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/03/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| action-ast-grep | < 1.26.2 | 1.26.2 |
| action-composite-template | < 0.20.2 | 0.20.2 |
| action-setup | = 1 | |
| action-shellcheck | < 1.29.2 | 1.29.2 |
| action-staticcheck | < 1.26.2 | 1.26.2 |
| action-typos | < 1.17.2 | 1.17.2 |
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free