PT-2025-35523 · Sonarqube · Sonarqube

Torbjorn-Svensson · Published 2025-09-02 · Updated 2025-09-22 · CVE-2025-58178

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SonarQube versions 4 through 5.3.0

Description SonarQube is a static analysis solution for continuous code quality and security inspection. A command injection issue was identified in the SonarQube Scan GitHub Action. Untrusted input arguments are processed without proper sanitization, allowing potential execution of arbitrary commands. Arguments sent to the action are treated as shell expressions.

Recommendations Update to SonarQube Scan GitHub Action version 5.3.1 or later.

Exploit

Fix

DoS

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-58178

GHSA-F79P-9C5R-XG88

Affected Products

Sonarqube

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58178.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-58178 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58178 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f79p-9c5r-xg88 · Vendor Advisory
• https://github.com/SonarSource/sonarqube-scan-action · Note
• https://github.com/SonarSource/sonarqube-scan-action/pull/200 · Note
• https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-f79p-9c5r-xg88 · Note
• https://github.com/SonarSource/sonarqube-scan-action/commit/016cabf33a6b7edf0733e179a03ad408ad4e88ba · Note
• https://twitter.com/BaseFortify/status/1962789244994236830 · Twitter Post
• https://community.sonarsource.com/t/security-advisory-sonarqube-scanner-github-action/147696 · Note
• https://twitter.com/Hossted_OSS/status/1970039987056877650 · Twitter Post
• https://twitter.com/BaseFortify/status/1962789242997702755 · Twitter Post
• https://t.me/CVEtracker/31468 · Telegram Post
• https://twitter.com/cracbot/status/1964644856636010631 · Twitter Post
• https://twitter.com/CVEnew/status/1962683390571766240 · Twitter Post