sonarcloud-scan

Bitbucket Pipelines Pipe: SonarQube Cloud scan Scan your code with SonarQube Cloud to detects bugs, vulnerabilities and code smells in more than 25 programming languages. Your SonarCloud account must first be associated to your Bitbucket team or user account. SonarQube Cloud is totally free for...

CVE-2025-58178

CVE-2025-58178 affects SonarQube-related tooling: the SonarQube Scan GitHub Action (versions up to 5.3.0) is vulnerable to command injection because untrusted input arguments are treated as shell expressions. This can lead to execution of arbitrary commands with local privileges. A fix is release...

PT-2025-35523

Name of the Vulnerable Software and Affected Versions SonarQube versions 4 through 5.3.0 Description SonarQube is a static analysis solution for continuous code quality and security inspection. A command injection issue was identified in the SonarQube Scan GitHub Action. Untrusted input arguments...