# CVE-2025-59844: Argument injection vulnerability in SonarQube Scan Action

> CVE-2025-59844: Argument injection vulnerability in SonarQube Scan Action. CVSS 7.7 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2025-59844
Last updated: 2026-10-09T10:10:00Z

- Published: 2025-09-26 16:24 UTC · Updated: 2026-10-09 10:10 UTC · Assigner: GitHub\_M
- CVSS: 7.7 (CVSS 4.0) · Severity: High
- EPSS: 1.5%, 74th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-78

## Description

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.

## Affected vendors and products

- SonarSource: sonarqube-scan-action

## Tracked companies

- [SonarCloud](https://rewindex.com/company/sonarcloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-59844)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-59844)
- [https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281](https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281)
- [https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0)
- [https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f](https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-5xq9-5g24-4g6f)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-59844 · Markdown: https://rewindex.com/cve/CVE-2025-59844.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-59844 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:50.463Z