GHSA-vqf5-2xx6-9wfm GitHub PAT written to debug artifacts

• GitHub Actions github/codeql-action: >= 3.26.11, < 3.28.3 → fixed in 3.28.3 • GitHub Actions github/codeql-action: < 3.0.0 (no fix yet)

Impact summary In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access this artifact, containing any secrets from the environment. For some affected workflow runs, the exposed environment variables in the debug artifacts included a valid `GITHUB_TOKEN` for the workflow run, which has access to the repository in which the workflow ran, and all the permissions specified in the workflow or job. The `GITHUB_TOKEN` is valid until the job completes or 24 hours has elapsed, whichever comes first. Environment variables are exposed only from workflow runs that satisfy all of the following conditions: • Code scanning workflow configured to scan the Java/Kotlin languages. • Running in a repository containing Kotlin source code. • Running with debug artifacts enabled. • Using CodeQL Action versions = 2.9.2 (May 2022) and = 3.26.11 (October 2024) and = 2.26.11 and = 2.9.2 and = 3.26.11 and = 2.26.11 and < 3, which in turn use the `actions/artifacts v4` library, the debug artifact is uploaded before the workflow job completes. During this time the `GITHUB_TOKEN` is still valid, providing an opportunity for attackers to gain access to the repository. • For all other workflows, the debug artifact is uploaded after the workflow job completes, at which point the leaked `GITHUB_TOKEN` has been revoked and cannot be used to access the repository. Mitigations Update to CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later. Patches This vulnerability has been fixed in CodeQL Action version 3.28.3, which no longer uploads database artifacts in debug mode. This vulnerability will be fixed in CodeQL CLI version 2.20.3, in which database creation for all languages no longer logs the complete environment by default. References • Pull request that bundled CodeQL CLI 2.9.2 with Kotlin extractor environment variable logging • Pull request that introduced the `actions/artifacts v4` library, allowing for `GITHUB_TOKEN` exposure in the CodeQL Action debug artifacts before the token was revoked • Related security advisory for the CodeQL CLI