GHSA-5xq9-5g24-4g6f

Suggest an improvement
Source
https://github.com/advisories/GHSA-5xq9-5g24-4g6f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-5xq9-5g24-4g6f/GHSA-5xq9-5g24-4g6f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5xq9-5g24-4g6f
Aliases
Published
2025-09-26T13:01:10Z
Modified
2025-09-29T14:23:15Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Argument injection vulnerability in SonarQube Scan Action
Details

A command injection vulnerability exists in SonarQube GitHub Action prior to v6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment.

Patches

The vulnerability has been fixed in version v6.0.0. Users should upgrade to this version or later.

Credits

Francois Lajeunesse-Robert (Boostsecurity.io)

References

  • Community Post: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281
  • Fix release: https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0
Database specific 
{
    "nvd_published_at": "2025-09-26T17:15:36Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed_at": "2025-09-26T13:01:10Z"
}
References

Affected packages

GitHub Actions / SonarSource/sonarqube-scan-action

Package

Name
SonarSource/sonarqube-scan-action

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
6.0.0