Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A command injection vulnerability exists in SonarQube GitHub Action prior to v6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. Patches The vulnerability has been fixed in version v6.0.0. Users should upgrade to this version or later. Credits Francois Lajeunesse-Robert (Boostsecurity.io) References - Community Post: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281 - Fix release: https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0
Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. Patches A fix has been released in SonarQube Scan GitHub Action v5.3.1.
Recommended action: Upgrade to 5.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.