Issues · github/codeql · GitHub

Labels Milestones New issue

GitHub Advanced Security Ruby File Issues Generated Using Absolute Path

#21802

· JLLeitschuh opened

on May 5, 2026

Ruby: &[SPACE][identifier] syntax breaks Ruby parsing

#21801

· JLLeitschuh opened

on May 5, 2026

CodeQL's default configuration generator is inconsistent with CodeQL's internal language detectors

#21787

· emeralddcw opened

on May 4, 2026

Python: add PyMongo read results as sources for `py/sql-injection` in second-order SQL construction flows

#21775

· invoke1442 opened

on Apr 29, 2026

Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

#21774

· invoke1442 opened

on Apr 29, 2026

Javascript: js/path-injection misses Sails Action2 request-derived inputs

#21773

· invoke1442 opened

on Apr 29, 2026

False negative in java/unvalidated-url-redirection for Spring MVC redirect view names

#21771

· invoke1442 opened

on Apr 29, 2026

False negative in go/email-injection for password reset links built from Forwarded / X-Forwarded-Host

#21770

· invoke1442 opened

on Apr 29, 2026

False negative: py/sql-injection missing a sqlite3/PEP249 pattern

#21769

· invoke1442 opened

on Apr 29, 2026

False negative: py/ldap-injection misses taint flow for ldap3 `extend.standard.paged_search`

#21738

· 9iang22 opened

on Apr 20, 2026

False negative: missing os.exec* APIs with `sh -c` as sink in py/code-injection.

#21735

· 9iang22 opened

on Apr 19, 2026

GHAS-managed workflows reference mutable action versions, incompatible with required SHA-pinning policies

#21732

· kyleburnsdev opened

on Apr 17, 2026