CVE-2025-59844 json
Argument injection vulnerability in SonarQube Scan Action
published 2025-09-26 13 mo ago modified 2026-10-09 31 d ago also EUVD-2025-31338 , GHSA-5xq9-5g24-4g6f
- cvss
- 7.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.
Patch / fix
- github-actions SonarSource/sonarqube-scan-action 6.0.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 13 mo ago
Exploit prediction
1.47% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| github-actions | SonarSource/sonarqube-scan-action | >=4.0.0, <6.0.0 |
6.0.0 |
Affected products
- SonarSource sonarqube-scan-action
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f
web
-
community.sonarsource.com
/t/sonarqube-scanner-github-action-v6/149281
web
-
github.com
/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59844
advisory
-
github.com
/SonarSource/sonarqube-scan-action
package
Sources
- CVE List CVE-2025-59844
- GitHub Advisory GHSA-5xq9-5g24-4g6f
- NVD CVE-2025-59844
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.