CVE-2021-32638

CVE-2021-32638 describes an information exposure vulnerability in GitHub's CodeQL action, affecting users running CodeQL on non-GitHub CI/CD systems. Previously, passing a GitHub access token via the --github-auth flag made it visible to other processes, potentially exposing it in system logs if publicly exposed. This could lead to unauthorized access to GitHub repositories. The vulnerability has a CVSS score of 4.4 (Medium), indicating a local attack vector with low attack complexity, requiring high privileges to exploit. The primary impact is high confidentiality loss, as the token could be compromised. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting low public attention.