EUVD-2024-22479

Malicious code in bioql PyPI...

CVE-2025-24362: Insertion of Sensitive Information into Log File

In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository...

CVE-2024-25129 Limited data exfiltration in CodeQL CLI

The CodeQL CLI repo holds binaries for the CodeQL command line interface CLI. Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously...

PT-2024-20768 · Unknown · Codeql Cli

Name of the Vulnerable Software and Affected Versions: CodeQL CLI versions prior to 2.16.3 Description: The CodeQL CLI is vulnerable to an XML External Entity attack due to an XML parser used to read auxiliary files. This vulnerability can be exploited when processing maliciously modified CodeQL...

CVE-2024-25129: Improper Restriction of XML External Entity Reference

The CodeQL CLI repo holds binaries for the CodeQL command line interface CLI. Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously...