
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued a warning about an active exploitation of a vulnerability in the GitHub Action, tj-actions/changed-files, highlighting it as part of its Known Exploited Vulnerabilities (KEV) catalog. This high-severity flaw, formally identified as CVE-2025-30066, holds a CVSS score of 8.6. It allows remote attackers to inject malicious code into the GitHub Action,