CVE-2025-58178

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has been released in SonarQube Scan GitHub Action 5.3.1.

• CWE-77

• https://community.sonarsource.com/t/security-advisory-sonarqube-scanner-github-action/147696
• https://github.com/SonarSource/sonarqube-scan-action/commit/016cabf33a6b7edf0733e179a03ad408ad4e88ba
• https://github.com/SonarSource/sonarqube-scan-action/pull/200
• https://github.com/SonarSource/sonarqube-scan-action/security/advisories/GHSA-f79p-9c5r-xg88
• https://sonarsource.atlassian.net/browse/SQSCANGHA-101

Published

Sep 2, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58172drawnix is an all in one open-source whiteboard tool. In dra…5.3
• CVE-2025-58173FreshRSS is a self-hosted RSS feed aggregator. In versions 1…8.8
• CVE-2025-58174LDAP Account Manager (LAM) is a webfrontend for managing ent…4.6
• CVE-2025-58175GeoServer is an open source server that allows users to shar…8.2
• CVE-2025-58176Dive is an open-source MCP Host Desktop Application that ena…8.8
• CVE-2025-58177n8n is an open source workflow automation platform. From 1.2…5.4
• CVE-2025-58179Astro is a web framework for content-driven websites. Versio…6.5
• CVE-2025-5818The Featured Image Plus – Quick & Bulk Edit with Unsplash pl…5.5
• CVE-2025-58180OctoPrint provides a web interface for controlling consumer …8.8
• CVE-2025-58181SSH servers parsing GSSAPI authentication requests do not va…5.3
• CVE-2025-58182Rejected reason: reserved but not needed
• CVE-2025-58183tar.Reader does not set a maximum size on the number of spar…4.3