Issues · github/codeql · GitHub

Labels Milestones New issue

cpp: how to use macro argument as dataflow sink

#21824

· k4lizen opened

on May 10, 2026

False positive in CWE-829 /UntrustedCheckoutMedium.ql

#21823

· tstellar opened

on May 9, 2026

GitHub Advanced Security Ruby File Issues Generated Using Absolute Path

#21802

· JLLeitschuh opened

on May 5, 2026

Ruby: &[SPACE][identifier] syntax breaks Ruby parsing

#21801

· JLLeitschuh opened

on May 5, 2026

CodeQL's default configuration generator is inconsistent with CodeQL's internal language detectors

#21787

· emeralddcw opened

on May 4, 2026

Python: add PyMongo read results as sources for `py/sql-injection` in second-order SQL construction flows

#21775

· invoke1442 opened

on Apr 29, 2026

Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

#21774

· invoke1442 opened

on Apr 29, 2026

Javascript: js/path-injection misses Sails Action2 request-derived inputs

#21773

· invoke1442 opened

on Apr 29, 2026

False negative in java/unvalidated-url-redirection for Spring MVC redirect view names

#21771

· invoke1442 opened

on Apr 29, 2026

False negative in go/email-injection for password reset links built from Forwarded / X-Forwarded-Host

#21770

· invoke1442 opened

on Apr 29, 2026

False negative: py/sql-injection missing a sqlite3/PEP249 pattern

#21769

· invoke1442 opened

on Apr 29, 2026

False negative: py/ldap-injection misses taint flow for ldap3 `extend.standard.paged_search`

#21738

· 9iang22 opened

on Apr 20, 2026