GitHub codeql action vulnerabilities

Latest GitHub codeql action CVEs

Newest publication first

1. CVE-2021-32638 CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated

   Published 2021-05-25

   Medium·CVSS 4.4 EPSS 0.40%

   Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.