Skip to content
OpenAdvisories

Product · GitHub

codeql-action

2 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Feed

  • High 7.1
    CVE-2025-24362

    CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts

    In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users…

    GitHub codeql-action github/codeql-action GitHub Actions
  • Medium 4.4
    CVE-2021-32638

    CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated

    Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-…

    GitHub codeql-action