reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

Exploited in the wild. Listed by CISA on 2025-03-24; known to be used by ransomware.

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Nonecheck to confirm it

reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

No ready check is stored for this CVE. Confirm it by hand from the references.

References

Use this check only on systems you are authorised to test. Where the data comes from