CVE-2025-59844: SonarQube GitHub Action RCE Vulnerability

CVE-2025-59844 Overview

CVE-2025-59844 is a command injection vulnerability in the SonarQube Scan GitHub Action affecting versions 4.0.0 through versions before 6.0.0. The flaw occurs when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. The vulnerability bypasses a prior security fix and enables arbitrary command execution within the GitHub Actions runner. Successful exploitation can expose sensitive environment variables, including secrets and tokens, and compromise the runner environment. SonarSource fixed the issue in version 6.0.0. The weakness is classified under CWE-78, OS Command Injection.

Critical Impact
Attackers with the ability to influence workflow inputs can execute arbitrary commands on Windows GitHub Actions runners and exfiltrate repository secrets and environment variables.

Affected Products

SonarQube Scan GitHub Action version 4.0.0
SonarQube Scan GitHub Action versions after 4.0.0 and before 6.0.0
Workflows executing the action on Windows runners with user-controlled args input

Discovery Timeline

2025-09-26 - CVE-2025-59844 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59844

Vulnerability Analysis

The SonarQube Scan GitHub Action wraps the SonarQube scanner CLI and forwards arguments supplied through the args workflow input. On Windows runners, the action invokes the scanner through a shell that interprets metacharacters before the command reaches the scanner binary. Input validation introduced by a previous patch did not sufficiently sanitize Windows-specific shell syntax, leaving an exploitable command injection path.

When workflows interpolate untrusted data such as pull request titles, branch names, issue bodies, or commit messages into the args value, an attacker controlling that data can inject additional commands. The action runs with the same privileges as the workflow job, granting access to GITHUB_TOKEN, repository secrets exposed to the step, and any cached credentials on the runner.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. The previous fix addressed POSIX shell syntax but did not account for Windows command interpreter behavior, including cmd.exe chaining characters such as &, |, and ^. Concatenating user input into a shell command line without context-aware escaping reintroduces the injection primitive on Windows runners.

Attack Vector

Exploitation requires a workflow that references the vulnerable action version and passes attacker-influenced data into args. A common pattern is a public repository workflow triggered by pull_request_target or issue_comment events, where external contributors can supply payloads. The injected commands execute during the SonarQube scan step, allowing the attacker to read environment variables, post secrets to external endpoints, modify build outputs, or pivot to other resources reachable from the runner.

No verified public proof-of-concept is available. Refer to the GitHub Security Advisory GHSA-5xq9-5g24-4g6f for technical details from the maintainers.

Detection Methods for CVE-2025-59844

Indicators of Compromise

Workflow run logs from sonarqube-scan-action steps containing unexpected shell metacharacters such as &, |, ^, or backticks within the args value
Outbound network connections from Windows GitHub Actions runners to unfamiliar hosts during a SonarQube scan step
Access or echo of environment variables such as GITHUB_TOKEN, SONAR_TOKEN, or other secrets in scan step output
Modification of workflow artifacts or repository contents immediately following a scan step on a Windows runner

Detection Strategies

Audit repositories for workflow files referencing SonarSource/sonarqube-scan-action at versions v4.x or v5.x and inspect any with: args: blocks for user-controlled interpolation such as ${{ github.event.pull_request.title }}
Review GitHub Actions run logs for the affected action on windows-latest or windows-* runners and search for anomalous command output
Correlate runner egress traffic with scan job timing to identify exfiltration attempts during the SonarQube step

Monitoring Recommendations

Forward GitHub Actions audit logs and workflow run logs to a centralized analytics platform for anomaly review
Enable secret scanning and push protection on repositories that rely on the affected action
Alert on workflow runs triggered by pull_request_target, issue_comment, or workflow_run events that invoke third-party actions with dynamic args

How to Mitigate CVE-2025-59844

Immediate Actions Required

Upgrade SonarSource/sonarqube-scan-action to version 6.0.0 or later in every workflow file across all repositories and organizations
Rotate any secrets that may have been exposed to vulnerable Windows runner jobs, including SONAR_TOKEN, GITHUB_TOKEN-derived credentials, and cloud provider keys
Remove direct interpolation of untrusted event data into the action's args parameter and pass values through environment variables instead
Restrict workflow triggers such as pull_request_target so that untrusted contributors cannot influence scan inputs

Patch Information

SonarSource released the fix in GitHub Release v6.0.0. Update workflow references from SonarSource/sonarqube-scan-action@v4 or @v5 to @v6 and pin to the published commit SHA where supply-chain pinning policies require it. Additional context is available in the SonarSource Community Discussion.

Workarounds

Run the SonarQube scan on Linux runners only until the upgrade to version 6.0.0 is complete
Pass user-supplied values through env: mappings and reference them inside the scanner configuration file rather than the args input
Validate or allowlist any data interpolated into workflow inputs, rejecting strings that contain shell metacharacters

bash

# Configuration example: pin the patched action and avoid direct interpolation
# .github/workflows/sonarqube.yml
jobs:
  sonarqube:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@v6.0.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        with:
          args: >
            -Dsonar.projectKey=my-project