sonarqube-scan-action vulnerabilities

2 known vulnerabilities in sonarqube-scan-action from SonarSource. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  sonarqube-scan-action: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-59844Sep 26, 2025SonarSourceEPSS 1.47%

  SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input

• 7.8 High severity

  sonarqube-scan-action: Improper Neutralization of Special Elements used in a Command

  CVE-2025-58178Sep 2, 2025SonarSourceEPSS 1.09%

  SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to