GitHub Vulnerabilities and Affected Products
Vulnerabilities associated with codeql-action.
Products
Clear product- Enterprise Server82 vulnerabilities
- GitHub Enterprise Server46 vulnerabilities
- enterprise_server15 vulnerabilities
- cmark-gfm10 vulnerabilities
- Opensearch3 vulnerabilities
- cli2 vulnerabilities
- codeql-action2 vulnerabilities
- copilot-cli2 vulnerabilities
- github-mcp-server2 vulnerabilities
- codeql-cli-binaries1 vulnerability
- github1 vulnerability
- go-gh1 vulnerability
- paste-markdown1 vulnerability
- secure_headers1 vulnerability
- trilogy1 vulnerability
- view_component1 vulnerability
- vscode-codeql1 vulnerability
- Webiness Inventory1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-24362HIGH | CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifactsIn some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access this artifact, containing any secrets from the environment. This vulnerability is patched in CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later. For some … | CVSS7.1v4.0 | EPSS1.22% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-32638MEDIUM | CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecatedGithub's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the process instead of reading it from a file, standard input, or an environment variable. This approach made the token visible to other processes on the same machine, for example in the output of the `ps` command. If the C… | CVSS4.4v3.1 | EPSS0.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |