build: 📦 sonarsource/sonarqube-scan-action action to v6 [security]#729

Open

renovate[bot] wants to merge 1 commit intomainfrom

renovate/github-tags-sonarsource-sonarqube-scan-action-vulnerability

renovate Bot commented Feb 27, 2026 •

edited

Loading

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/sonarqube-scan-action	action	major	`v4.2.1` → `v6.0.0`

Command Injection via sonarqube-scan-action GitHub Action

CVE-2025-58178 / GHSA-f79p-9c5r-xg88

More information

Details

Impact

A command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands.

Patches

A fix has been released in SonarQube Scan GitHub Action v5.3.1.

Severity

CVSS Score: 7.8 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Argument injection vulnerability in SonarQube Scan Action

CVE-2025-59844 / GHSA-5xq9-5g24-4g6f

More information

Details

A command injection vulnerability exists in SonarQube GitHub Action prior to v6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment.

Patches

The vulnerability has been fixed in version v6.0.0. Users should upgrade to this version or later.

Credits

Francois Lajeunesse-Robert (Boostsecurity.io)

References

Community Post: https://community.sonarsource.com/t/sonarqube-scanner-github-action-v6/149281
Fix release: https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v6.0.0

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)

`v6`

`v6.0`

`v6.0.0`

BREAKING CHANGE!

In order to prevent command-line injection, the actions has been rewritten from Bash to JS, and the args input is now parsed differently. When updating to v6, you might have to update your workflow to change how arguments are quoted.
For example, if you were previously passing:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      -Dsonar.projectName="My Project"

you should now pass:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      "-Dsonar.projectName=My Project"

For more args passing examples, please refer to the README file

What's Changed

SQSCANGHA-106 Migrate from Bash to JS by @jeremy-davis-sonarsource in #208

Full Changelog: SonarSource/sonarqube-scan-action@v5.3.1...v6.0.0

`v5.3.2`

Full Changelog: SonarSource/sonarqube-scan-action@v5.3.1...v5.3.2

`v5.3.1`

OVERLOOKED BREAKING CHANGE!

In order to prevent command-line injection, the way to parse the args input has been changed, but this is possibly a breaking change regarding support of quotes.

For example, if you were previously passing:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      -Dsonar.projectName="My Project"

you should now pass:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      "-Dsonar.projectName=My Project"

Edit: We have now released v6 that more accurately reflect this breaking change.

What's Changed

SQSCANGHA-101 Add more input injection tests by @aleksandra-bozhinoska-sonarsource in #200

New Contributors

@daantimmer made their first contribution in #199

Full Changelog: SonarSource/sonarqube-scan-action@v5...v5.3.1

`v5.3.0`

What's Changed

SQSCANGHA-83 Avoid unbound variable error on parameter expansion by @aleksandra-bozhinoska-sonarsource in #192
SQSCANGHA-97 Use /usr/bin/env for shebang by @eliandoran in #193
SQSCANGHA-98 Update SonarScanner CLI to 7.2.0.5079 by @github-actions[bot] in #196

New Contributors

@eliandoran made their first contribution in #193

Full Changelog: SonarSource/sonarqube-scan-action@v5.2.0...v5.3.0

`v5.3`

`v5.2`

`v5.2.0`

What's Changed

SQSCANGHA-90 remove mend dead conf by @pierre-guillot-gh in #184
SQSCANGHA-89 Attempt to fix command injection by @henryju in #186
SQSCANGHA-93 Fix madhead/semver-utils' version by @csaba-feher-sonarsource in #187
SQSCANGHA-94 Update version update logic by @csaba-feher-sonarsource in #188
SQSCANGHA-92 Validate scanner version by @csaba-feher-sonarsource in #189

Full Changelog: SonarSource/sonarqube-scan-action@v5...v5.2.0

`v5.1`

`v5.1.0`

What's Changed

Update SonarScanner CLI to 7.1.0.4889 to support sonar.region=us by @github-actions in #183

Full Changelog: SonarSource/sonarqube-scan-action@v5.0.0...v5.1.0

`v5.0`

`v5.0.0`

What's Changed

SQSCANGHA-81 Update SonarScanner CLI to 7.0.2.4839 by @github-actions in #175

Full Changelog: SonarSource/sonarqube-scan-action@v4...v5.0.0

`v5`

`v4.2.2`

Full Changelog: SonarSource/sonarqube-scan-action@v4.2.1...v4.2.2

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot changed the title ~~build: 📦 sonarsource/sonarqube-scan-action action to v6 [security]~~ build: 📦 sonarsource/sonarqube-scan-action action to v6 [security] - autoclosed

renovate Bot closed this

renovate Bot deleted the renovate/github-tags-sonarsource-sonarqube-scan-action-vulnerability branch

March 27, 2026 04:49


          build: 📦 sonarsource/sonarqube-scan-action action to v6 [security]

5462df6

renovate Bot changed the title ~~build: 📦 sonarsource/sonarqube-scan-action action to v6 [security] - autoclosed~~ build: 📦 sonarsource/sonarqube-scan-action action to v6 [security]

renovate Bot reopened this

renovate Bot force-pushed the renovate/github-tags-sonarsource-sonarqube-scan-action-vulnerability branch 2 times, most recently from f23647f to 5462df6 Compare

March 30, 2026 22:26

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet