CVE-2025-59844

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59844", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-22T14:34:03.472Z", "datePublished": "2025-09-26T16:24:55.126Z", "dateUpdated": "2025-09-26T17:31:50.867Z"}, "containers": {"cna": {"title": "Argument injection vulnerability in SonarQube Scan Action", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f"}, {"name": "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281", "tags": ["x_refsource_MISC"], "url": "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281"}, {"name": "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0"}], "affected": [{"vendor": "SonarSource", "product": "sonarqube-scan-action", "versions": [{"version": ">= 4.0.0, < 6.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-26T16:24:55.126Z"}, "descriptions": [{"lang": "en", "value": "SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later."}], "source": {"advisory": "GHSA-5xq9-5g24-4g6f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-26T17:29:59.080562Z", "id": "CVE-2025-59844", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T17:31:50.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59844", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-26T17:29:59.080562Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T17:31:01.848Z"}}], "cna": {"title": "Argument injection vulnerability in SonarQube Scan Action", "source": {"advisory": "GHSA-5xq9-5g24-4g6f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "SonarSource", "product": "sonarqube-scan-action", "versions": [{"status": "affected", "version": ">= 4.0.0, < 6.0.0"}]}], "references": [{"url": "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f", "name": "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281", "name": "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0", "name": "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-26T16:24:55.126Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59844", "state": "PUBLISHED", "dateUpdated": "2025-09-26T17:31:50.867Z", "dateReserved": "2025-09-22T14:34:03.472Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-26T16:24:55.126Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sonarqube-scan-action", "vendor": "SonarSource", "versions": [{"status": "affected", "version": ">= 4.0.0, < 6.0.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later."}, {"lang": "es", "value": "SonarQube Server y Cloud es una soluci\u00f3n de an\u00e1lisis est\u00e1tico para la inspecci\u00f3n continua de la calidad y seguridad del c\u00f3digo. Existe una vulnerabilidad de inyecci\u00f3n de comandos en SonarQube GitHub Action en la versi\u00f3n 4.0.0 hasta antes de la versi\u00f3n 6.0.0 cuando los flujos de trabajo pasan entrada controlada por el usuario al par\u00e1metro args en ejecutores de Windows sin la validaci\u00f3n adecuada. Esta vulnerabilidad elude una correcci\u00f3n de seguridad anterior y permite la ejecuci\u00f3n arbitraria de comandos, lo que podr\u00eda llevar a la exposici\u00f3n de variables de entorno sensibles y al compromiso del entorno del ejecutor. La vulnerabilidad ha sido corregida en la versi\u00f3n 6.0.0. Los usuarios deben actualizar a esta versi\u00f3n o posterior."}], "id": "CVE-2025-59844", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59844", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-26T17:29:59.080562Z", "version": "2.0.3"}}]}, "published": "2025-09-26T17:15:36.853", "references": [{"source": "security-advisories@github.com", "url": "https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281"}, {"source": "security-advisories@github.com", "url": "https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-29T09:30:20.091711+00:00", "updated": "2025-09-29T09:30:20.091768+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$windows", "sonarsource", "sonarsource$PRODUCT$sonarqube_scanner"]}