A command injection vulnerability in the SonarQube Scan GitHub Action allows local attackers to execute arbitrary code, necessitating an immediate update to version 5.3.1 or later.

This is a command injection vulnerability (CWE-77) where untrusted input arguments are processed as shell expressions without sanitization. The vulnerability requires local access to the build environment to manipulate action arguments, as indicated by the CVSS vector AV:L/PR:L.

Successful exploitation allows an attacker to achieve full code execution within the context of the GitHub Action runner. This can lead to the compromise of CI/CD secrets, source code exfiltration, and the injection of malicious code into the software supply chain. With a CVSS score of 7.8, this vulnerability represents a high risk to the integrity and confidentiality of the development environment.

Immediate Action: Update the SonarQube Scan GitHub Action to version 5.3.1 or later immediately to resolve the command injection flaw.

Proactive Monitoring: Review GitHub Actions workflow logs for any anomalous or unexpected shell commands executed during the scan phase.

Compensating Controls: Restrict access to repository settings and workflow configurations to trusted personnel only, and utilize GitHub environment secrets to minimize the impact of a compromised runner.

Public Exploit Available: Unknown.

Given the potential for supply chain compromise, organizations using the SonarQube Scan GitHub Action must prioritize updating to version 5.3.1. Failure to patch this vulnerability could expose critical development infrastructure to unauthorized command execution, undermining the entire security posture of the software delivery process.