High · published March 15, 2025
CVSS calls it high at 8.6. It is confirmed in active exploitation. It sits in the 99.4th percentile for exploit probability.
🚨 A sneaky update could expose your secrets! The tj-actions changed-files component has been compromised, putting your sensitive data at risk. ⚡ Think of it like a restaurant where a sneaky chef switched the menus, allowing anyone to see the secret recipes — if you're not careful, the whole kitchen is open for the taking! If exploited, this vulnerability could allow attackers to access your actions logs, uncovering sensitive information and secrets that could lead to further compromises. It's like leaving the backdoor to your house wide open for anyone to walk in!
Think of it like a restaurant where a sneaky chef switched the menus, allowing anyone to see the secret recipes — if you're not careful, the whole kitchen is open for the taking! This vulnerability arises because versions before 46 of tj-actions changed-files improperly handled actions logs, allowing remote attackers to read them and discover sensitive data. The malicious commit effectively modified the component's behavior without raising any alarms.
If exploited, this vulnerability could allow attackers to access your actions logs, uncovering sensitive information and secrets that could lead to further compromises. It's like leaving the backdoor to your house wide open for anyone to walk in! Update to tj-actions changed-files version 46 or later immediately to close this leak. Additionally, review your actions logs to ensure no sensitive information has been compromised during the affected period. Don't forget to tighten up access controls! You’ve got this! By taking these steps, you'll protect your secrets and keep your digital fortress secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tj-actions/changed-files | ≤ 45.0.7 | — |