CVE-2025-59844

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.

CVSS

No CVSS.

References

Link	Resource
https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281
https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0
https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f

Configurations

No configuration.

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) SonarQube Server y Cloud es una solución de análisis estático para la inspección continua de la calidad y seguridad del código. Existe una vulnerabilidad de inyección de comandos en SonarQube GitHub Action en la versión 4.0.0 hasta antes de la versión 6.0.0 cuando los flujos de trabajo pasan entrada controlada por el usuario al parámetro args en ejecutores de Windows sin la validación adecuada. Esta vulnerabilidad elude una corrección de seguridad anterior y permite la ejecución arbitraria de comandos, lo que podría llevar a la exposición de variables de entorno sensibles y al compromiso del entorno del ejecutor. La vulnerabilidad ha sido corregida en la versión 6.0.0. Los usuarios deben actualizar a esta versión o posterior.

Information

Published : 2025-09-26 17:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-59844

Mitre link : CVE-2025-59844

CVE.ORG link : CVE-2025-59844

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-59844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59844", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-26T17:29:59.080562Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "SonarSource", "product": "sonarqube-scan-action", "versions": [{"status": "affected", "version": ">= 4.0.0, < 6.0.0"}]}]}], "published": "2025-09-26T17:15:36.853", "references": [{"url": "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281", "source": "security-advisories@github.com"}, {"url": "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later."}, {"lang": "es", "value": "SonarQube Server y Cloud es una soluci\u00f3n de an\u00e1lisis est\u00e1tico para la inspecci\u00f3n continua de la calidad y seguridad del c\u00f3digo. Existe una vulnerabilidad de inyecci\u00f3n de comandos en SonarQube GitHub Action en la versi\u00f3n 4.0.0 hasta antes de la versi\u00f3n 6.0.0 cuando los flujos de trabajo pasan entrada controlada por el usuario al par\u00e1metro args en ejecutores de Windows sin la validaci\u00f3n adecuada. Esta vulnerabilidad elude una correcci\u00f3n de seguridad anterior y permite la ejecuci\u00f3n arbitraria de comandos, lo que podr\u00eda llevar a la exposici\u00f3n de variables de entorno sensibles y al compromiso del entorno del ejecutor. La vulnerabilidad ha sido corregida en la versi\u00f3n 6.0.0. Los usuarios deben actualizar a esta versi\u00f3n o posterior."}], "lastModified": "2026-10-09T10:10:00.193", "sourceIdentifier": "security-advisories@github.com"}