CVE-2025-58178: SonarQube Scan GitHub Action RCE Flaw

CVE-2025-58178 Overview

CVE-2025-58178 is a command injection vulnerability in the SonarQube Scan GitHub Action, affecting versions 4 through 5.3.0. Untrusted input arguments passed to the action are treated as shell expressions without proper sanitization. Attackers who can influence the arguments supplied to the action can execute arbitrary commands within the GitHub Actions runner context. The issue is tracked under [CWE-77] (Command Injection) and has been fixed in SonarQube Scan GitHub Action 5.3.1.

Critical Impact

Arbitrary command execution in the CI/CD runner, enabling theft of workflow secrets, tampering with build artifacts, and lateral movement into connected systems.

Affected Products

• SonarQube Scan GitHub Action versions 4.0.0 through 5.3.0
• SonarQube Server integrations invoking the vulnerable action
• SonarQube Cloud integrations invoking the vulnerable action

Discovery Timeline

• 2025-09-02 - CVE-2025-58178 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58178

Vulnerability Analysis

The SonarQube Scan GitHub Action wraps the SonarQube Scanner CLI in a shell script that constructs the scanner command line from workflow inputs. The args input was appended directly into a bash array expansion using "$@", which allowed shell metacharacters within the input to be interpreted rather than passed as literal arguments. When a workflow forwarded attacker-controlled data, such as a pull request title or branch name, into the args input, the shell evaluated embedded expressions.

Execution occurs on the GitHub Actions runner with the privileges of the workflow. Consequences include exposure of GITHUB_TOKEN, repository secrets, cached credentials, and any cloud tokens loaded into environment variables. Attackers can also modify source or build outputs before they reach downstream systems.

Root Cause

The root cause is unsafe handling of the INPUT_ARGS value inside the entrypoint scripts. Arguments were splatted into a bash array without tokenization or quoting, so shell expressions such as command substitution $(...) and backticks were evaluated at scanner launch time. The fix in commit 016cabf3 introduces regex-based tokenization of INPUT_ARGS and passes the value via an environment variable rather than as script parameters.

Attack Vector

Exploitation requires the ability to influence the args input of the SonarQube Scan GitHub Action in a target workflow. Common paths include pull_request_target workflows that echo untrusted PR metadata into scanner arguments, or reusable workflows exposing args as a caller-controlled input. No authentication to SonarQube is required.

# Vulnerable pattern (pre-patch, scripts/run-sonar-scanner-cli.sh)
scanner_args+=("$@")

# Fixed pattern (post-patch, commit 016cabf3)
args=()
if [[ -n "${INPUT_ARGS}" ]]; then
#  the regex recognizes args with values in single or double quotes (without character escaping), and args without quotes as well
#  more specifically, the following patterns: -Darg="value", -Darg='value', -Darg=value, "-Darg=value" and '-Darg=value'
  IFS=$'\n'; args=($(echo ${INPUT_ARGS} | egrep -o '[^" '\'']+="[^"]*"|[^" '\'']+='\''[^'\'']*'\''|[^" '\'']+|"[^"]+"|'\''[^'\'']+'\'''))
fi

for arg in "${args[@]}"; do
  scanner_args+=("$arg")
done

Source: GitHub Commit 016cabf3

Detection Methods for CVE-2025-58178

Indicators of Compromise

• Unexpected child processes spawned by run-sonar-scanner-cli.sh or run-sonar-scanner.sh during CI jobs.
• Outbound network connections from GitHub Actions runners to attacker-controlled hosts during a SonarQube scan step.
• Workflow logs containing shell metacharacters ($(, backticks, ;, &&) in the resolved args line.
• Secrets or environment variables appearing in scan output or exfiltrated via DNS or HTTP requests.

Detection Strategies

• Audit repositories for use of SonarSource/sonarqube-scan-action pinned to versions 4.0.0 through 5.3.0.
• Grep workflow YAML for args: values that reference github.event.pull_request.*, github.head_ref, or other untrusted context fields.
• Enable GitHub Actions job log streaming to a SIEM and alert on anomalous process creation from scanner scripts.

Monitoring Recommendations

• Forward runner audit logs and process telemetry to a centralized data lake for retrospective search.
• Monitor for new outbound destinations from self-hosted runners performing SonarQube scans.
• Track GitHub secret scanning and secret access events for tokens tied to CI pipelines.

How to Mitigate CVE-2025-58178

Immediate Actions Required

• Upgrade SonarSource/sonarqube-scan-action to version 5.3.1 or later in all workflows.
• Rotate any secrets, tokens, and SonarQube credentials that were available to affected workflows.
• Review recent workflow runs for anomalous scanner invocations or unexpected network egress.

Patch Information

The fix is delivered in SonarQube Scan GitHub Action 5.3.1. The patch tokenizes INPUT_ARGS using a regex and passes it through an environment variable rather than as positional shell arguments. Details are documented in the GitHub Security Advisory GHSA-f79p-9c5r-xg88, the SonarSource Security Advisory, and Pull Request #200.

Workarounds

• Remove any args input values derived from untrusted context such as pull request titles, branch names, or issue bodies.
• Avoid using pull_request_target with the SonarQube Scan action on repositories accepting external contributions.
• Pin the action to the fixed commit 016cabf3 if a full version bump is not immediately feasible.

# Upgrade to the patched version by updating the workflow reference
# .github/workflows/sonar.yml
- name: SonarQube Scan
  uses: SonarSource/sonarqube-scan-action@v5.3.1
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  with:
    args: >
      -Dsonar.projectKey=my-project
      -Dsonar.sources=src