Hi You added a new rule S8263 on 16 mar 2026 Azure Pipelines Task invocations should not be vulnerable to parameter injection attacks I think it gives false positive. Example we have task: DotNetCoreCLI@2 displayName: ‘Build ${{ parameters.buildConfiguration }}’ inputs: command: buil…

Hi @HenrikSommer-eng , I am terribly sorry that you had to wait so long for a response! To your question, this is actually a true positive as arguments can be used to pass extra arguments to msbuild which can affect the execution (e.g., to set BeforeBuildEvent to execute arbitrary commands). I will …

[image] Teemu Rytilahti: I will find a way to improve the documentation to make this clearer, thanks a lot for the feedback! Thanks that help. And yes the guide line should be updated because it was not clear that was problem.

Hi again, The improved description explaining both types of issues in more detail has been released, thanks again for reporting! Best wishes, Teemu R.

False positive with S8263

SonarQube Cloud

Topic		Replies	Views
Secure your CI/CD, Secure your Azure Pipelines Sonar Updates security , pipeline , azure-devops	0	127	March 17, 2026
Complying with azurepipelines:S8263 when env vars aren't transmitted Report False-positive / False-negative...	3	211	June 18, 2026
Azure Pipelines SonarCloudPrepare@3 sonar.exclusions not working SonarQube Cloud coverage , dotnet , userfriendly-pl , sonarqube-cloud	20	989	February 18, 2025
Security hotspot on azure-pipelines.yml (azurepipelines:S7637) SonarQube Cloud azuredevops-services , security-hotspot	3	243	May 28, 2026
Error message from "Prepare analysis on SonarQube" Azure DevOps task v5.6.0 SonarQube Server / Community Build dotnet	16	1842	July 12, 2022

False positive with S8263

Related topics