---
title: "Security digest: March 14, 2025"
url: https://erroneo.us/security/2025-03-14/
description: "March 14, 2025 vulnerability digest: 1 brief (tj-actions/changed-files compromise); 5 critical advisories (npm, RubyGems, PyPI). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-03-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 14, 2025

1 editorial brief and 5 critical advisories.

## Take stock

- Check exposure: tj-actions/changed-files compromise . Anyone whose workflows ran tj-actions/changed-files on March 14-15, 2025, or a reviewdog action on March 11, 2025, especially in public repositories, and who never rotated the secrets those jobs could read.
- npm: 3 critical advisories ( xml-crypto , flowise ). Check with npm audit (or: npm ls <package>) .
- RubyGems: 1 critical advisory ( camaleon_cms ). Check with bundle audit check --update .
- PyPI: 1 critical advisory ( qiskit-terra , qiskit ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [tj-actions/changed-files: GitHub Action Leaked CI Secrets](https://erroneo.us/security/briefs/tj-actions-changed-files-compromise/index.md): The malicious tags were cleaned up within about a day in March 2025; today the job is confirming you rotated any secret that a March 14-15, 2025 workflow run could have printed, and that you pin Actions by SHA.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2025-29775](https://erroneo.us/security/cve/CVE-2025-29775/index.md) xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment — npm xml-crypto >= 4.0.0, < 6.0.1 → 6.0.1; npm xml-crypto >= 3.0.0, < 3.2.1 → 3.2.1; npm xml-crypto < 2.1.6 → 2.1.6
- [CVE-2025-2304](https://erroneo.us/security/cve/CVE-2025-2304/index.md) Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment — RubyGems camaleon_cms < 2.9.1 → 2.9.1
- [CVE-2025-29774](https://erroneo.us/security/cve/CVE-2025-29774/index.md) xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References — npm xml-crypto >= 4.0.0, < 6.0.1 → 6.0.1; npm xml-crypto >= 3.0.0, < 3.2.1 → 3.2.1; npm xml-crypto < 2.1.6 → 2.1.6
- [GHSA-8vvx-qvq9-5948](https://erroneo.us/security/ghsa/GHSA-8vvx-qvq9-5948/index.md) Flowise allows arbitrary file write to RCE — npm flowise <= 2.2.7 → no fix
- [CVE-2025-2000](https://erroneo.us/security/cve/CVE-2025-2000/index.md) Qiskit allows arbitrary code execution decoding QPY format versions < 13 — PyPI qiskit-terra >= 0.18.0, <= 0.46.3 → no fix; PyPI qiskit <= 1.4.1 → 1.4.2; PyPI qiskit = 2.0.0rc1 → 2.0.0rc2

---
Source page: https://erroneo.us/security/2025-03-14/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt