GHSA-f79p-9c5r-xg88

Suggest an improvement
Source
https://github.com/advisories/GHSA-f79p-9c5r-xg88
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-f79p-9c5r-xg88/GHSA-f79p-9c5r-xg88.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f79p-9c5r-xg88
Aliases
Published
2025-09-02T17:31:57Z
Modified
2025-09-02T17:44:25.726705Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Command Injection via sonarqube-scan-action GitHub Action
Details

Impact

A command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands.

Patches

A fix has been released in SonarQube Scan GitHub Action v5.3.1.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-77"
    ],
    "severity": "HIGH",
    "nvd_published_at": null,
    "github_reviewed_at": "2025-09-02T17:31:57Z"
}
References

Affected packages

GitHub Actions / SonarSource/sonarqube-scan-action

Package

Name
SonarSource/sonarqube-scan-action

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
5.3.1

Database specific 

{
    "last_known_affected_version_range": "<= 5.3.0"
}