What is GHSA-5xq9-5g24-4g6f?

GHSA-5xq9-5g24-4g6f is a security advisory published by GitHub Security Advisories with High severity. Argument injection vulnerability in SonarQube Scan Action

Which CVE IDs does GHSA-5xq9-5g24-4g6f cover?

GHSA-5xq9-5g24-4g6f covers the following CVE IDs: CVE-2025-59844. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-5xq9-5g24-4g6f?

GHSA-5xq9-5g24-4g6f affects 1 product, including: actions/SonarSource/sonarqube-scan-action:\u003e= 4.0.0, \u003c 6.0.0.

GHSA-5xq9-5g24-4g6fHigh

Argument injection vulnerability in SonarQube Scan Action

Vendor

GitHub Security Advisories

Published

September 26, 2025

Last Modified

September 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-59844 →

📋 Description

A command injection vulnerability exists in SonarQube GitHub Action prior to v6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment.

Patches

The vulnerability has been fixed in version v6.0.0. Users should upgrade to this version or later.

Credits

Francois Lajeunesse-Robert (Boostsecurity.io)

References

Community Post: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281
Fix release: https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0

🎯 Affected products1

actions/SonarSource/sonarqube-scan-action:>= 4.0.0, < 6.0.0