GCVE - cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tj-actions:changed-files:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Tj Actions (`553b216a-5ea3-5f11-890e-059e04c5c426`)
Product	Changed Files (`54846abe-404f-5eb5-93c8-1c849cdfcfcb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/tj-actions/changed-files`	purl2cpe	2026-06-01 10:16:44.489265

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-30066`	vulnerable	2026-06-08 07:16:59.027315	Details available HIGH (8.6) tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.) Published: 2025-03-15T00:00:00.000Z Updated: 2026-02-26T19:09:29.628Z Open on db.gcve.eu Reference links https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193 https://github.com/tj-actions/changed-files/issues/2463 https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/ https://news.ycombinator.com/item?id=43368870	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-51664`	vulnerable	2026-06-08 06:17:53.696687	tj-actions/changed-files command injection in output filenames HIGH (7.3) tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade. Published: 2023-12-27T16:58:31.908Z Updated: 2024-09-25T20:17:19.352Z Open on db.gcve.eu Reference links https://github.com/tj-actions/changed-files/security/advisories/GHSA-mcph-m25j-8j63 https://github.com/tj-actions/changed-files/commit/0102c07446a3cad972f4afcbd0ee4dbc4b6d2d1b https://github.com/tj-actions/changed-files/commit/716b1e13042866565e00e85fd4ec490e186c4a2f https://github.com/tj-actions/changed-files/commit/ff2f6e6b91913a7be42be1b5917330fe442f2ede	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.