Authenticated command execution via unvalidated args

Command injection in SonarQube Scan GitHub Action 4.0.0 through 5.3.1 allows remote authenticated users to execute commands on Windows runners. The Bash-based action incorporates the args input into its scanner command without fully neutralizing shell metacharacters, bypassing earlier filtering. Exploitation requires a workflow to feed attacker-controlled data into args on a Windows runner; injected commands run with the job's permissions and can read its environment variables.