CVE-2025-24362: CodeQL Action Information Disclosure Flaw

CVE-2025-24362 Overview

CVE-2025-24362 is an information disclosure vulnerability in the GitHub CodeQL Action that exposes workflow environment variables — including the GITHUB_TOKEN and user-defined secrets — through debug artifacts uploaded after a failed code scanning run. The flaw affects CodeQL Action versions <= 3.28.2 and CodeQL CLI versions >= 2.9.2 and <= 2.20.2 when scanning Java or Kotlin repositories with debug artifacts enabled. Any user with read access to the affected repository can download the artifact and recover the exposed secrets. The issue is classified under [CWE-532] (Insertion of Sensitive Information into Log File).

Critical Impact

A leaked GITHUB_TOKEN valid for up to 24 hours can grant attackers the workflow's repository permissions, enabling supply chain attacks against the scanned repository.

Affected Products

• GitHub CodeQL Action versions <= 3.28.2 (patched in 3.28.3)
• GitHub CodeQL CLI versions >= 2.9.2 through <= 2.20.2 (patched in 2.20.3)
• Repositories scanning Java or Kotlin source code on GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server

Discovery Timeline

• 2025-01-24 - CVE-2025-24362 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-24362

Vulnerability Analysis

The CodeQL Kotlin extractor writes the complete process environment into an intermediate file while building a CodeQL database. Under normal execution, this file is removed when the database is finalized. When the workflow fails before finalization inside the github/codeql-action/analyze step, the file remains on disk and is bundled into the debug artifact that the action uploads on failure.

The debug artifact is stored in GitHub Actions and is downloadable by any user with read access to the repository. On GitHub.com and GitHub Enterprise Cloud, CodeQL Action versions >= 3.26.11 and <= 3.28.2 upload artifacts using actions/artifacts v4, which transmits the artifact before the job completes. Because the GITHUB_TOKEN remains valid until job completion or 24 hours, an attacker who retrieves the artifact during that window can authenticate to the repository with the workflow's permissions.

Root Cause

The Kotlin extractor in the CodeQL CLI logs all environment variables by default during database creation. This includes GITHUB_TOKEN and any secret injected via env: in the workflow. The cleanup step that deletes the intermediate log only runs after successful database finalization, leaving secrets in the working tree on failure paths.

Attack Vector

A user with repository read access — including external contributors on public repositories — can navigate to a failed code scanning workflow run, download the debug artifact, and parse the Kotlin extractor logs to extract environment variables. On GitHub.com and GitHub Enterprise Cloud running affected versions, the attacker can then replay the still-valid GITHUB_TOKEN to push commits, modify workflows, or read additional secrets, enabling supply chain compromise.

// Patch in lib/debug-artifacts.js — uploading debug artifacts is disabled
     if (toUpload.length === 0) {
         return;
     }
+    logger.info("Uploading debug artifacts is temporarily disabled");
+    return;
     let suffix = "";
     const matrix = (0, actions_util_1.getRequiredInput)("matrix");
     if (matrix) {

Source: GitHub CodeQL Action Commit 519de267

Detection Methods for CVE-2025-24362

Indicators of Compromise

• Debug artifacts named my-debug-artifacts-* attached to failed code scanning workflow runs in repositories containing Kotlin source code.
• Use of a GITHUB_TOKEN from a code scanning workflow run to perform Git operations, REST/GraphQL API calls, or artifact downloads from an unexpected IP address.
• Workflow runs configured with CODEQL_ACTION_DEBUG: true or ACTIONS_STEP_DEBUG: true that fail inside the github/codeql-action/analyze step.

Detection Strategies

• Audit the GitHub Actions API for failed CodeQL workflow runs on Java/Kotlin repositories that uploaded debug artifacts while using vulnerable CodeQL Action versions.
• Inspect repository audit logs for git.clone, actions.workflow_run, or pull_request events authenticated by the workflow's GITHUB_TOKEN after the artifact upload timestamp.
• Correlate artifact download events with subsequent privileged repository activity from the same actor.

Monitoring Recommendations

• Continuously inventory CodeQL Action and CodeQL CLI versions across all repositories using GitHub's dependency graph or organization-level workflow scans.
• Alert on any code scanning workflow that enables debug mode in production, especially on repositories handling secrets.
• Monitor the GitHub Security Advisory GHSA-vqf5-2xx6-9wfm and related GHSA-gqh3-9prg-j95m advisories for updated guidance.

How to Mitigate CVE-2025-24362

Immediate Actions Required

• Upgrade CodeQL Action to 3.28.3 or later and CodeQL CLI to 2.20.3 or later in all workflows that pin a fixed version.
• Delete any existing debug artifacts produced by failed CodeQL runs on Java/Kotlin repositories using vulnerable versions.
• Rotate any user-defined secrets that were exposed as environment variables to affected workflows.
• Review repository audit logs for unauthorized use of the GITHUB_TOKEN issued to affected workflow runs.

Patch Information

The fix is committed in 519de267, which disables debug artifact uploads pending a deeper remediation, and is shipped in CodeQL Action 3.28.3. The Kotlin extractor in CodeQL CLI 2.20.3 no longer logs the full environment. See pull requests #1074 and #2482 for the implementation details.

Workarounds

• Disable debug artifact uploads by removing debug: true and unsetting ACTIONS_STEP_DEBUG from CodeQL workflows until patched versions are deployed.
• Avoid passing sensitive secrets as environment variables to CodeQL workflows; use the action's documented inputs instead.
• Restrict repository read access where feasible so untrusted users cannot download workflow artifacts on private repositories.

# Pin CodeQL Action to a patched version in .github/workflows/codeql.yml
- uses: github/codeql-action/init@v3.28.3
  with:
    languages: java-kotlin
# Ensure debug mode is not enabled in production scans
# debug: false  (default)