Skip to content
OpenAdvisories

Product · GitHub

codeql-action

2 known vulnerabilities.

All Critical High Medium Low Exploited only

1 result · Clear filters · Feed

  • High 7.1
    CVE-2025-24362

    CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts

    In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users…

    GitHub codeql-action github/codeql-action GitHub Actions