GitHub Sharpens CodeQL’s Eye on Actions Workflows and Modern JavaScript

GitHub has released CodeQL 2.26.3, focusing on enhancing security for GitHub Actions workflows and JavaScript/TypeScript code. The update bolsters GitHub's ability to detect cache-poisoning and output-clobbering attacks, which often go unnoticed due to the lack of thorough scrutiny of workflow files. Actions-focused changes include an improved output-clobbering query, tailored messages for specific output channels, and the elimination of false positives caused by jq path filters.

Cache-poisoning and untrusted-checkout queries now start alert paths at the expressions controlling untrusted checkouts, providing more direct links to the responsible code. CodeQL also accounts for read-only cache access in low-trust triggers, reducing false alarms for workflows that cannot poison a cache. Other notable improvements include correct classification of the schedule event, reduced false positives in environment-variable injection queries, and the removal of the codeql.actions.security.SelfHostedQuery module due to reliability issues.

Vue developers will appreciate the addition of flow models for Vue's Composition API helpers and Sails Action2 controllers. A promise-wrapped client response data change now tracks tainted data through promise fulfillment values in modern fetch and axios-based applications. Overall, the release aims to deliver quieter, more accurate alerts, reducing noise and helping security teams focus on genuine issues.

DevOps and platform teams should update their CodeQL suites, except those using the removed SelfHostedQuery module, which should review custom query suites before the next scan.