GHSA-5xq9-5g24-4g6f
Argument injection vulnerability in SonarQube Scan Action
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| GitHub Actions | SonarSource/sonarqube-scan-action | >= 4.0.0, < 6.0.0 | 6.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A command injection vulnerability exists in SonarQube GitHub Action prior to v6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment.
### Patches
The vulnerability has been fixed in version v6.0.0. Users should upgrade to this version or later.
### Credits
Francois Lajeunesse-Robert (Boostsecurity.io)
### References
- Community Post: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281
- Fix release: https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0
References
External links from the advisory. They lead to third-party sites.
- https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f
- https://nvd.nist.gov/vuln/detail/CVE-2025-59844
- https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281
- https://github.com/SonarSource/sonarqube-scan-action
- https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0