7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58178

CVE-2025-58178: Command Injection via sonarqube-scan-action GitHub Action

Impact

A command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands.

Patches

A fix has been released in SonarQube Scan GitHub Action v5.3.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58178

CVE-2025-58178:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
SonarSource/sonarqube-scan-action	actions	>= 4.0.0, <= 5.3.0	5.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic command injection in a GitHub Action. The root cause is in the action.yml file, where user-provided inputs.args were directly substituted into a shell command. The shell then interpreted these arguments, executing any embedded commands.

The analysis of the patch 016cabf33a6b7edf0733e179a03ad408ad4e88ba clearly shows the vulnerable code and the fix. The vulnerable part was the run step of the Run SonarScanner job in action.yml. It took the inputs.args and performed shell expansion on them: args=(${{ inputs.args }}). This is dangerous because it allows an attacker to inject commands.

The fix involves two main changes:

In action.yml, the arguments are no longer directly placed into the run block. Instead, they are passed as an environment variable INPUT_ARGS to a new wrapper script, run-sonar-scanner.sh.
The script that ultimately processes the arguments, run-sonar-scanner-cli.sh, was heavily modified. It no longer accepts arguments directly from the command line ($@). Instead, it reads the INPUT_ARGS environment variable and uses a regular expression with egrep to safely parse the arguments, correctly handling quotes and preventing the shell from executing injected commands.

Therefore, the function run-sonar-scanner-cli.sh is identified as the vulnerable function. While the injection point was in action.yml, this script is the component that would appear in a runtime profile as it's the one processing the malicious input passed by the action's runner.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.