PT-2025-39662 · Sonarsource · Sonarqube

Published 2025-09-26 · Updated 2025-10-08 · CVE-2025-59844

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SonarQube versions prior to 6.0.0

Description A command injection issue exists in the SonarQube GitHub Action when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment.

Recommendations Upgrade to version 6.0.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-59844

GHSA-5XQ9-5G24-4G6F

Affected Products

Sonarqube

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59844.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59844 · Security Note
• https://osv.dev/vulnerability/GHSA-5xq9-5g24-4g6f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59844 · Vendor Advisory
• https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0 · Note
• https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f · Note
• https://github.com/SonarSource/sonarqube-scan-action · Note
• https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281 · Note
• https://t.me/CVEtracker/33486 · Telegram Post
• https://twitter.com/SecAideInfo/status/1972606290523267120 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1971688784287748202 · Twitter Post
• https://twitter.com/CVEnew/status/1971617099052134678 · Twitter Post
• https://twitter.com/pHo9UBenaA/status/1972869051014922739 · Twitter Post