{"answers":{"affected":"2 open source packages ship an affected version, including github/codeql-action.","exploited":"There is no known exploitation of CVE-2025-24362 in the wild and no public exploit code.","fix":"Upgrade github/codeql-action to 3.28.3 or later.","what":"CVE-2025-24362 is a high-severity vulnerability in github codeql-action, published on 24 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-24362 and fix it if it is affected.\n\nWhat it is: CVE-2025-24362 is a high-severity vulnerability in github codeql-action, published on 24 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-24362 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github/codeql-action (GitHub Actions): affected from 2.26.11; no fix listed\n- github/codeql-action (GitHub Actions): affected from 3.26.11; fixed in 3.28.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-24362/ (Markdown: https://insights.sbomify.com/CVE-2025-24362/index.md)","id":"CVE-2025-24362","markdown":"https://insights.sbomify.com/CVE-2025-24362/index.md","name":"CVE-2025-24362","record":{"aliases":["GHSA-vqf5-2xx6-9wfm"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"GitHub CodeQL Action","requires_auth":"low_privilege","summary":"Attackers with repository read access can retrieve exposed secrets and GitHub tokens from debug artifacts in failed CodeQL workflows.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"description":"In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access this artifact, containing any secrets from the environment. This vulnerability is patched in CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later.\n\nFor some affected workflow runs, the exposed environment variables in the debug artifacts included a valid `GITHUB_TOKEN` for the workflow run, which has access to the repository in which the workflow ran, and all the permissions specified in the workflow or job. The `GITHUB_TOKEN` is valid until the job completes or 24 hours has elapsed, whichever comes first.\n\nEnvironment variables are exposed only from workflow runs that satisfy all of the following conditions:\n- Code scanning workflow configured to scan the Java/Kotlin languages.\n- Running in a repository containing Kotlin source code.\n- Running with debug artifacts enabled.\n- Using CodeQL Action versions \u003c= 3.28.2, and CodeQL CLI versions \u003e= 2.9.2 (May 2022) and \u003c= 2.20.2.\n- The workflow run fails before the CodeQL database is finalized within the `github/codeql-action/analyze` step.\n- Running in any GitHub environment: GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server. Note: artifacts are only accessible to users within the same GitHub environment with access to the scanned repo.\n\nThe `GITHUB_TOKEN` exposed in this way would only have been valid for workflow runs that satisfy all of the following conditions, in addition to the conditions above:\n- Using CodeQL Action versions \u003e= 3.26.11 (October 2024) and \u003c= 3.28.2, or \u003e= 2.26.11 and \u003c 3.\n- Running in GitHub.com or GitHub Enterprise Cloud only (not valid on GitHub Enterprise Server).\n\nIn rare cases during advanced setup, logging of environment variables may also occur during database creation of Java, Swift, and C/C++. Please read the corresponding CodeQL CLI advisory GHSA-gqh3-9prg-j95m for more details.\n\nIn CodeQL CLI versions \u003e= 2.9.2 and \u003c= 2.20.2, the CodeQL Kotlin extractor logs all environment variables by default into an intermediate file during the process of creating a CodeQL database for Kotlin code. This is a part of the CodeQL CLI and is invoked by the CodeQL Action for analyzing Kotlin repositories. \n\nOn Actions, the environment variables logged include GITHUB_TOKEN, which grants permissions to the repository being scanned.\nThe intermediate file containing environment variables is deleted when finalizing the database, so it is not included in a successfully created database. It is, however, included in the debug artifact that is uploaded on a failed analysis run if the CodeQL Action was invoked in debug mode.\n\nTherefore, under these specific circumstances (incomplete database creation using the CodeQL Action in debug mode) an attacker with access to the debug artifact would gain unauthorized access to repository secrets from the environment, including both the `GITHUB_TOKEN` and any user-configured secrets made available via environment variables.\n\nThe impact of the `GITHUB_TOKEN` leaked in this environment is limited:\n- For workflows on GitHub.com and GitHub Enterprise Cloud using CodeQL Action versions \u003e= 3.26.11 and \u003c= 3.28.2, or \u003e= 2.26.11 and \u003c 3, which in turn use the `actions/artifacts v4` library, the debug artifact is uploaded before the workflow job completes. During this time the `GITHUB_TOKEN` is still valid, providing an opportunity for attackers to gain access to the repository.\n- For all other workflows, the debug artifact is uploaded after the workflow job completes, at which point the leaked `GITHUB_TOKEN` has been revoked and cannot be used to access the repository.","ecosystems":["GitHub Actions"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts","id":"CVE-2025-24362","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"GitHub Actions","product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":2,"n_references":6,"next":{"headline":"The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information","id":"CVE-2025-24363"},"packages":[{"ecosystem":"GitHub Actions","fixed":[],"introduced":["2.26.11"],"last_affected":[],"package":"github/codeql-action","purl":null,"source":"GHSA-vqf5-2xx6-9wfm"},{"ecosystem":"GitHub Actions","fixed":["3.28.3"],"introduced":["3.26.11"],"last_affected":[],"package":"github/codeql-action","purl":null,"source":"GHSA-vqf5-2xx6-9wfm"}],"prev":{"headline":"Opening a malicious website while running a Nuxt dev server could allow read-only access to code","id":"CVE-2025-24361"},"products":["codeql-action"],"published":"2025-01-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-03-31","vendors":["github"]},"summary":"Attackers with repository read access can retrieve exposed secrets and GitHub tokens from debug artifacts in failed CodeQL workflows.","url":"https://insights.sbomify.com/CVE-2025-24362/"}