ByteOS Network

NVD Vulnerability Details :

CVE-2025-58178

Awaiting Analysis

Source-security-advisories@github.com

Published At-02 Sep, 2025 | 01:15

Updated At-02 Sep, 2025 | 15:55

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has been released in SonarQube Scan GitHub Action 5.3.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE ID	Type	Source
CWE-77	Primary	security-advisories@github.com

CWE ID: CWE-77

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://community.sonarsource.com/t/security-advisory-sonarqube-scanner-github-action/147696	security-advisories@github.com	N/A
https://github.com/SonarSource/sonarqube-scan-action/commit/016cabf33a6b7edf0733e179a03ad408ad4e88ba	security-advisories@github.com	N/A
https://github.com/SonarSource/sonarqube-scan-action/pull/200	security-advisories@github.com	N/A
https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-f79p-9c5r-xg88	security-advisories@github.com	N/A
https://sonarsource.atlassian.net/browse/SQSCANGHA-101	security-advisories@github.com	N/A