github/codeql

View on GitHub

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

Stars: 10.1k
Forks: 2.1k
Open beginner issues: 1
Indexed issues: 999
Avg merge: 2d 18h
Merged PRs (30d): 152

Dominant language: CodeQL
License: MIT
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 16, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

998 open issues indexed

CodeQL Ruby extractor: parse errors on valid Ruby 3 constructs Open

Ruby

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#21130 · 1 comment · Opened Jan 8, 2026
False positive — CodeQL failing due to lack of Python files when they only exist on the `main` branch Open

acknowledged bug false-positive

Difficulty 4/5 3-5 days Newbie friendliness 25/100

github/codeql#21106 · 4 comments · 1 reaction · Opened Jan 6, 2026
"CodeQL library search" page is broken Open

acknowledged bug

github/codeql#21083 · 4 comments · 1 reaction · 1 assignee · Opened Dec 26, 2025
Code Hinting for Rust is really Slow Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#21080 · 2 comments · 1 reaction · Opened Dec 24, 2025
Organization owned immutable actions raise warning about unpinned 3rd party actions tag Open

false-positive

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

github/codeql#21076 · 3 comments · 3 reactions · Opened Dec 21, 2025
JavaScript extractor ignores html files although docs (and code) say it may also be analyzed Open

question

Difficulty 3/5 1-2 days Newbie friendliness 38/100

github/codeql#21048 · 4 comments · Opened Dec 16, 2025
False positive: "Missing function level access control" where public endpoint name contains "Edit" Open

C# false-positive

Difficulty 3/5 1-2 days Newbie friendliness 45/100

github/codeql#21042 · 1 comment · Opened Dec 16, 2025
General issue: CWE-116 not reported for unescaped XML output in JavaScript/TypeScript Open

question

Difficulty 4/5 3-5 days Newbie friendliness 30/100

github/codeql#21022 · 1 comment · Opened Dec 12, 2025
General issue: CWE-208 coverage for javascript Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#21021 · 1 comment · Opened Dec 12, 2025
[csharp] sql injection detection not working? Open

question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#21003 · 12 comments · Opened Dec 10, 2025
Unable to create database on latest Linux kernel Open

bug C++ question

Difficulty 4/5 3-5 days Newbie friendliness 45/100

github/codeql#20978 · 11 comments · Opened Dec 7, 2025
LeakSanitizer detects memory leak from CodeQL `x86_64-linux-gnu_x86_64_trace.so` when executing Rust fuzzing test in OneBranch pipeline Open

question

Difficulty 4/5 3-5 days Newbie friendliness 25/100

github/codeql#20976 · Opened Dec 5, 2025
[Python] False Negative: Taint flow fails to penetrate function-local class definitions Open

question

Difficulty 4/5 3-5 days Newbie friendliness 45/100

github/codeql#20947 · 4 comments · Opened Dec 2, 2025
Can CodeQL add support for YAML configuration files parse on java lib? Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#20905 · 1 comment · Opened Nov 25, 2025
C path matching issue Open

acknowledged question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20882 · 1 comment · Opened Nov 21, 2025
General issue: XSS vulnerabilities (CWE-79/CWE-116) not detected in React/Next.js .tsx components Open

acknowledged bug JS

Difficulty 4/5 3-5 days Newbie friendliness 38/100

github/codeql#20846 · 2 comments · Opened Nov 17, 2025
False positive: Dereferenced variable may be null ignore NRT attributes Open

C# false-positive

Difficulty 4/5 3-5 days Newbie friendliness 38/100

github/codeql#20828 · 2 comments · Opened Nov 12, 2025
.NET 10 Support Open

question

Difficulty 4/5 3-5 days Newbie friendliness 48/100

github/codeql#20827 · 10 comments · 6 reactions · Opened Nov 12, 2025
General issue: Is or can F# be supported? Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#20785 · 3 comments · Opened Nov 9, 2025
[Rust] How do I query function and module attributes? Open

question Rust

Difficulty 3/5 1-2 days Newbie friendliness 25/100

github/codeql#20771 · 2 comments · Opened Nov 7, 2025
getMetrics appears to be miscounting blank lines in docstrings Open

Python question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20766 · 1 comment · Opened Nov 5, 2025
False positive `Explicit export is not defined` for item backed by `__getattr__` Open

false-positive

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20764 · Opened Nov 5, 2025
[Actions] CWE-285/ImproperAccessControl.ql Not Currently Working Open

question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20706 · 4 comments · Opened Oct 28, 2025
False positive: This expression has no effect (because _function with multiple implementations_ has no external side effects [in incorrectly selected version]). Open

C++ false-positive

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20684 · 5 comments · Opened Oct 23, 2025
C++20 modules support Open

question

Difficulty 5/5 Over a week Newbie friendliness 20/100

github/codeql#20674 · 1 comment · Opened Oct 22, 2025
[Rust] Proc macro expansion support Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#20659 · 4 comments · Opened Oct 19, 2025
No codeql for linux ARM64 Open

question

Difficulty 4/5 3-5 days Newbie friendliness 52/100

github/codeql#20616 · 17 comments · Opened Oct 9, 2025
FP in UseAfterFree with reallocating data structures Open

C++ false-positive

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20577 · 1 comment · Opened Oct 2, 2025
[Python] General issue: Wrong domination is reported in control flow analysis Open

question

github/codeql#20551 · 1 comment · 1 assignee · Opened Sep 29, 2025
[Java] Taint Tracking for JNI Field Access and Object Aliasing in Java Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#20536 · 5 comments · Opened Sep 27, 2025
[Rust] Including dependencies in the analysis Open

question Rust

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#20534 · 4 comments · Opened Sep 26, 2025
[Rust] Get type of expression Open

question Rust

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20501 · 7 comments · 1 reaction · Opened Sep 22, 2025
[CLI] Expose shell completions for `codeql` command Open

question

Difficulty 3/5 1-2 days Newbie friendliness 45/100

github/codeql#20493 · 3 comments · Opened Sep 19, 2025
False positive: Workflow does not contain permissions Open

false-positive

Difficulty 3/5 1-2 days Newbie friendliness 35/100

github/codeql#20487 · 10 comments · 8 reactions · Opened Sep 18, 2025
False positive on actions/unpinned-tag for immutable third party action Open

false-positive

Difficulty 4/5 3-5 days Newbie friendliness 44/100

github/codeql#20458 · 3 comments · 6 reactions · Opened Sep 17, 2025
Rust for Web 3.0 Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

github/codeql#20456 · 2 comments · 1 reaction · Opened Sep 17, 2025
False positive: MongoDB no sql injection Open

false-positive

Difficulty 5/5 Over a week Newbie friendliness 30/100

github/codeql#20455 · 2 comments · Opened Sep 17, 2025
C Engineering Compiler Adaptation Open

question

Difficulty 5/5 Over a week Newbie friendliness 20/100

github/codeql#20428 · 4 comments · Opened Sep 15, 2025
[C#] General issue: CodeQL scanner encounters issues without reporting them Open

question

Difficulty 4/5 3-5 days Newbie friendliness 30/100

github/codeql#20353 · 2 comments · Opened Sep 3, 2025
[JS]General issue: ES6 Analysis Seems Unsupported Open

question

Difficulty 3/5 1-2 days Newbie friendliness 35/100

github/codeql#20261 · 3 comments · Opened Aug 21, 2025
General issue: MetricCallable Kotlin Open

question

Difficulty 4/5 3-5 days Newbie friendliness 32/100

github/codeql#20259 · 1 comment · Opened Aug 21, 2025
CodeQL Ruby parser fails on bare & block forwarding in multi-line method calls Open

bug question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20257 · 1 comment · Opened Aug 20, 2025
[Rust] Unused variable False positive Open

false-positive

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20256 · 2 comments · Opened Aug 20, 2025
Codeql pack create warning - is not an extension target of xxx Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

github/codeql#20211 · 4 comments · 1 reaction · Opened Aug 12, 2025
[Rust] Unused variable false positive in compound conditional statements Open

false-positive

Difficulty 4/5 3-5 days Newbie friendliness 38/100

github/codeql#20201 · 3 comments · Opened Aug 10, 2025
[Docs] Consistently refer to either `codeql-pack.yml` or `qlpack.yml` Open

question

Difficulty 3/5 1-2 days Newbie friendliness 35/100

github/codeql#20187 · 2 comments · Opened Aug 7, 2025
Query: increase size of code-snippet context exported in SARIF? Open

question

Difficulty 4/5 3-5 days Newbie friendliness 35/100

github/codeql#20176 · 1 comment · Opened Aug 6, 2025
False positive in python/ql/src/Security/CWE-312/CleartextLogging.ql Open

false-positive

Difficulty 3/5 1-2 days Newbie friendliness 35/100

github/codeql#20168 · 1 comment · Opened Aug 4, 2025
Java SSRF Findings Open

false-positive question

Difficulty 4/5 3-5 days Newbie friendliness 25/100

github/codeql#20144 · 2 comments · 1 reaction · Opened Jul 30, 2025
For an abstract class in the CodeQL source code, how can I quickly find all the classes that extend this abstract class from the CodeQL library? Open

question

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

github/codeql#20125 · 1 comment · Opened Jul 25, 2025

github/codeql

Get new issues in your inbox