RCE in Sonarsource Sonarqube-Scan-Action
CVE-2025-58178
SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has been released in SonarQube Scan GitHub Action 5.3.1.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.011 (62.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sonarsource Sonarqube-scan-action — versions >= 4, < 5.3.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-58178?
- CVE-2025-58178 is a high-severity vulnerability in Sonarsource Sonarqube-Scan-Action, classified under Command Injection. CVSS score: 7.8/10. Published 2025-09-02.
- How severe is CVE-2025-58178?
- High severity. CVSS v3 base score is 7.8 out of 10.