GitHub Advisoryadvisory · GitHub Actions

GHSA-5xq9-5g24-4g6f Argument injection vulnerability in SonarQube Scan Action

HIGH Published 2025-09-26 Modified 2025-09-29 Official page ↗
Aliases
CVE-2025-59844
Ecosystem
GitHub Actions
Packages
SonarSource/sonarqube-scan-action
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-78
Reviewed
2025-09-26

Affected packages

• GitHub Actions SonarSource/sonarqube-scan-action: >= 4.0.0, < 6.0.0 → fixed in 6.0.0

Description

A command injection vulnerability exists in SonarQube GitHub Action prior to v6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. Patches The vulnerability has been fixed in version v6.0.0. Users should upgrade to this version or later. Credits Francois Lajeunesse-Robert (Boostsecurity.io) References • Community Post: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281 • Fix release: https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0

Related

Alias · CVE (1)

  • CVE-2025-59844 SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References