Update 9/25/2025: Please read this follow-up post: [image] SonarQube Scanner GitHub Action v6 sonarSonar Updates Hello everyone, As a follow-up to our previous security update , we have released a new major version of the SonarQube Scanner GitHub Action . This …

We are using SonarCloud, linking our project with GitHub directly, but we have not written or configured any .yml file for GitHub Actions (i.e., we are not actively using the SonarQube Scanner GitHub Action in our workflow). Could you please confirm whether this vulnerability impacts SonarCloud user…

Hi @Jagrit , Welcome to the community! This only impacts the use of the SonarScanner GitHub Action. Again, [image] G Ann Campbell: Your use of any other SonarScanner is not impacted. HTH, Ann

Could you please provide the following critical details: Severity Level: What is the CVSS score or severity rating of this vulnerability? Attack Vector & Exploitability: Is this remotely exploitable? Does it require authentication? What level of access could an attacker gain? Spe…

Exactly. Given the complete lack of transparency here, I’m not at all reassured by the fact that Sonar has no evidence that this vulnerability, whatever it is, was not exploited. I need to know whether I should be spending my weekend rotating secrets or whether this is a nothing burger. What a horri…

[image] ganncamp: If your workflow uses dynamically computed arguments, you will additionally need to switch to using supported syntax for expressions in GitHub Actions . What does this mean? I am aware of GiHub Actions’ expressions syntax, but what are “dynamically computed arguments” in this…

Ok, I figured out that you mean the args input on the Sonar action. Needing to change, for example, from: --define sonar.cfamily.compile-commands="$RUNNER_TEMP/sonar/compile_commands.json" to --define sonar.cfamily.compile-commands=${{ runner.temp }}/sonar/compile_commands.json Presumably becau…

You should also release an update for the deprecated SonarSource/sonarcloud-github-action . Currently it still delegates to a vulnerable version of SonarSource/sonarqube-scan-action inside its action.yml: - name: SonarQube Cloud Scan uses: SonarSource/sonarqube-scan-action@v5.0.0 wit…

Unfortunately, we won’t be able to share anything more until we have that. In the meantime - and without prematurely releasing sensitive details so that everyone has an opportunity to do the update - we can say we believe this is “high” severity. Versions since v4.0.0 are impacted. Just as a sid…

+1; withholding further information at this point is just a form of security through obscurity (i.e. ineffective) and prevents those of us who are affected from properly assessing the level of risk and impact without taking Sonar’s word for it. [image] ganncamp: (And we’ll be taking the learnin…

We are using “sonarsource/sonarqube-scan-action@master” this automatically take the latest version?

Security Advisory: SonarQube Scanner GitHub Action

Sonar Updates

Colin (Colin) September 25, 2025, 1:44pm 26

Hey everybody,

Take a look at this follow-up post.

Topic		Replies	Views
Sonar analyzes GitHub Actions workflows Sonar Updates security , github-actions	3	329	October 13, 2025
Sonarqube scanner github SonarQube Server / Community Build	1	49	September 2, 2025
SonarQube scans erroring and not reporting meaningful results since last week SonarQube Cloud sonarqube , scanner , coverage , sonarqube-cloud	12	162	February 4, 2026
Outage: SonarScanner CLI Docker + SonarQube & SonarCloud GitHub Actions Sonar Updates scanner	34	2638	June 14, 2024
Github: SonarCloud is reporting errors. Check the SonarCloud status page for help SonarQube Cloud	45	1473	November 17, 2025

Security Advisory: SonarQube Scanner GitHub Action

Related topics