Debug Artifacts Vulnerability in GitHub CodeQL Action

CVE-2025-24362

Summary

A vulnerability exists in GitHub's CodeQL Action where debug artifacts may inadvertently expose environment variables, including sensitive secrets such as the GITHUB_TOKEN. This token grants extensive access to repositories, and under certain conditions—specifically with Java/Kotlin scanning workflows and debug mode enabled—these secrets can be accessed by users who have read access to the repository. This issue arises during failed workflow runs occurring in specific GitHub environments. It is recommended to upgrade to CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later to mitigate the risk of secret leakage.

References