CVE-2025-58178: Command Injection Vulnerability in SonarSource SonarQube Scan Action
Summary
CVE-2025-58178: Command Injection via sonarqube-scan-action GitHub Action. Affects SonarSource/sonarqube-scan-action versions >= 4.0.0, < 5.3.1. Fixed in 5.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SonarSource SonarQube Scan Action is a GitHub Action designed to facilitate the integration of SonarQube into CI/CD pipelines. It allows developers to analyze code quality and security vulnerabilities automatically during the build process. This action is widely used in projects to ensure code maintainability and adherence to best practices. However, a command injection vulnerability has been identified in versions up to 5.3.0, which could allow attackers to execute arbitrary commands through untrusted input.
Vulnerability Detail
A command injection vulnerability was discovered in the SonarQube Scan GitHub Action. This vulnerability arises from the action's failure to properly sanitize input arguments, allowing untrusted data to be processed as shell expressions. As a result, an attacker could potentially execute arbitrary commands on the host system where the action is running. This could lead to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Minimum fixed version
5.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update to the patched version, consider validating and sanitizing all input parameters before passing them to the SonarQube Scan Action. This can help mitigate the risk of command injection until you can apply the official fix.
Conclusion
The command injection vulnerability in the SonarSource SonarQube Scan Action poses a significant risk to users of the action. It is crucial to update to version 5.3.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your open-source dependencies effectively.
See every vulnerability recorded for SonarSource/sonarqube-scan-action →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the system running the GitHub Action, leading to unauthorized access and potential data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, ensure that all input parameters are validated and sanitized to reduce the risk of command injection until you can apply the official fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for SonarSource/sonarqube-scan-action.
