SonarSource vulnerabilities
We track 4 vulnerabilities in SonarSource products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 26, 2025.
Latest SonarSource vulnerabilities
- 7.7 High severity
sonarqube-scan-action: Improper Neutralization of Special Elements used in an OS Command
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input
- 7.8 High severity
sonarqube-scan-action: Improper Neutralization of Special Elements used in a Command
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to
- 7.2 High severity
sonarqube: Improper Neutralization of Special Elements used in an SQL Command
In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.
- 7.2 High severity
sonarqube: Improper Access Control
An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.