SonarQube GitHub Action Command Injection Vulnerability

A command injection vulnerability has been identified in the SonarQube GitHub Action, specifically in versions 4.0.0 prior to 6.0.0. This vulnerability arises when workflows on Windows runners pass user-controlled input to the 'args' parameter without adequate validation. As a result, the vulnerability bypasses a previous security fix, allowing arbitrary command execution. This exploitation could lead to the exposure of sensitive environment variables and compromise the runner environment.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected Windows runner, potentially leading to exposure of sensitive environment variables and compromise of the runner environment.

Remediation

Users are advised to upgrade to SonarQube GitHub Action version 6.0.0 or later.