Command Injection via sonarqube-scan-action GitHub Action
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has been released in SonarQube Scan GitHub Action 5.3.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SonarSource | sonarqube-scan-action | 4 to before 5.3.1 | 5.3.1 | Patch available | CNA |
| — | SonarSource/sonarqube-scan-action (GitHub Actions) | 4.0.0 to before 5.3.1 | 5.3.1 | Patch available | GHSA-f79p-9c5r-xg88 |
- sonarqube-scan-action VendorSonarSource Affected 4 to before 5.3.1 Fixed in 5.3.1 Patch available CNA
- SonarSource/sonarqube-scan-action (GitHub Actions) Vendor— Affected 4.0.0 to before 5.3.1 Fixed in 5.3.1 Patch available GHSA-f79p-9c5r-xg88
Remediation
- Fix · CNA sonarqube-scan-action (SonarSource) Fixed in 5.3.1
- Fix · GHSA-f79p-9c5r-xg88 SonarSource/sonarqube-scan-action (GitHub Actions) Fixed in 5.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58178
- 2026-10-03 Alias added: GHSA-f79p-9c5r-xg88
References
Other 6
- https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-f79p-9c5r-xg88
- https://github.com/SonarSource/sonarqube-scan-action/pull/200
- https://github.com/SonarSource/sonarqube-scan-action/commit/016cabf33a6b7edf0733e179a03ad408ad4e88ba
- https://community.sonarsource.com/t/security-advisory-sonarqube-scanner-github-action/147696
- https://sonarsource.atlassian.net/browse/SQSCANGHA-101
- https://github.com/SonarSource/sonarqube-scan-action
More SonarSource vulnerabilities
- TI-2020-17021 SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab… CVSS 3.1HIGH 7.5
- TI-2020-17875 The official sonarqube docker images before alpine (Alpine specific) contain a blank… CVSS 3.1CRITICAL 9.8
- TI-2025-37283 Argument injection vulnerability in SonarQube Scan Action CVSS 4.0HIGH 7.7
- TI-2024-32164 In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in… CVSS 3.1HIGH 7.2
- TI-2018-15898 An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner… CVSS 3.0HIGH 7.8
- TI-2024-25703 In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-58178 · CVE Program
- CVE-2025-58178 · NVD
- FIRST EPSS
- GHSA-f79p-9c5r-xg88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences