CodeQL 2.26.3: Better GitHub Actions Security and JS/TS Source Modeling

GitHub released CodeQL 2.26.3 on 19 August 2026, bringing tighter security analysis for GitHub Actions workflows and expanded source modeling for JavaScript, TypeScript, and Vue projects. The update improves query accuracy across cache-poisoning, output-clobbering, and environment-variable injection checks, while adding flow model support for Vue's Composition API and Vue Router. There is one breaking change: the SelfHostedQuery module has been dropped and any custom queries that depended on it need to be rewritten.

What happened

Area	Change
Release date	19 August 2026
Breaking change	codeql.actions.security.SelfHostedQuery module removed
New JS/TS sources	Vue ref, shallowRef, toRef, reactive, computed; Vue Router useRoute(); Sails Action2 inputs
New C/C++ sources	RegQueryValue and related winreg.h functions
Queries improved	output-clobbering, cache-poisoning, envvar-injection, untrusted-checkout, missing-rate-limiting
Deployment	Automatic on GitHub.com; manual upgrade required for older GitHub Enterprise Server

CodeQL is the static analysis engine behind GitHub code scanning. It examines your code for security vulnerabilities without running it, by modelling how data flows from untrusted inputs (sources) through to dangerous operations (sinks).

GitHub Actions query improvements

Several workflow-level queries received accuracy fixes in this release. The actions/output-clobbering/high query no longer fires false positives on simple jq path filters when their output stays JSON-encoded. A performance bug caused by unescaped regex input in the same query has also been fixed.

The envvar-injection query tightens its logic in two ways. First, the untrusted source and the privileged context must now come from the same trigger event. Second, pull request head labels are no longer treated as injection-capable, because they cannot contain newlines.

Cache-poisoning queries (code-injection, direct-cache, and poisonable-step) now account for read-only cache access on low-trust triggers running in the default branch scope, keeping alerts only where GitHub actually permits cache writes. The untrusted-checkout query now starts alert paths at the expressions that control the checkout, making the findings easier to trace.

One important addition: the GitHub Actions analysis now recognises untrusted data in github.event.merge_group for workflows triggered by the merge_group event, and the schedule event is now correctly classified when determining whether a workflow can be triggered externally.

The breaking change you need to act on

The codeql.actions.security.SelfHostedQuery module has been removed entirely. GitHub’s reasoning: runner labels do not reliably tell you whether a runner is self-hosted or GitHub-managed. If any of your custom queries import this module, they will break. Update those queries before upgrading.

JavaScript and TypeScript source modeling

This release adds meaningful depth for Vue and Sails developers. CodeQL now models Vue’s Composition API helpers (ref, shallowRef, toRef, reactive, and computed) as flow models, meaning taint tracking works through these functions correctly.

Vue Router’s useRoute() is now recognised as a client-side remote flow source, including its query, params, path, fullPath, and hash members. Query parameters pulled from the URL are a common injection vector, so this is a practical win for Vue applications that do routing on the client.

Sails Action2 controller inputs properties are now treated as remote flow sources. According to GitHub, this may improve results for the js/path-injection query. Similarly, queries using the response threat model now track promise-wrapped client response data into promise fulfillment values, which may improve js/xss results.

Custom models can now reference specific files using a package name in the form file:<path>, which lets teams define sources and sinks based on a file’s public exports rather than relying purely on package-level declarations.

The js/missing-rate-limiting query gains recognition for the @fastify/rate-limit package, so Fastify-based APIs that already use rate limiting will no longer generate false positives on this query.

Why it matters

For teams running JavaScript or TypeScript applications with Vue on the frontend, CodeQL’s previous blind spots around Composition API data flow meant some injection paths went undetected in automated scans. That gap narrows with this release.

The GitHub Actions improvements are equally practical. CI/CD pipelines are a frequent attack surface, and queries that fire too many false positives get ignored or disabled. Fewer false positives mean teams are more likely to act on the alerts that remain.

For those using GitHub Enterprise Server, note that this version will ship in a future GHES release. You can manually upgrade CodeQL now if you do not want to wait. GitHub.com users are already on 2.26.3 automatically.

Our take

The removal of SelfHostedQuery is the right call. Runner labels have always been a shaky signal for distinguishing self-hosted from managed infrastructure, and queries built on that assumption give false confidence. It is a breaking change, but a sensible one.

The Vue and Sails additions are genuinely useful rather than cosmetic. Composition API patterns are now mainstream in Vue 3 projects, and without explicit modeling of ref or useRoute(), taint analysis simply cannot follow data through those abstractions. Teams running Vue frontends with user-controlled routing should re-run their scans after this update and check whether new findings appear in path-injection or XSS queries.

If your team ships web applications and wants a broader look at how static analysis fits into a secure development workflow, our web development service includes security-aware build practices. You can also track how tooling like this evolves through our AI and developer tools news coverage.

What to do about it

1. Search your custom CodeQL query packs for any import of codeql.actions.security.SelfHostedQuery and remove or rewrite those queries before upgrading.
2. If you are on GitHub Enterprise Server, check the GHES release notes for when 2.26.3 lands, or manually upgrade CodeQL if you need these fixes now.
3. Re-run code scanning on Vue 3 and Sails projects and review any new js/path-injection or js/xss alerts that appear as a result of the improved source modeling.
4. Verify that Fastify APIs using @fastify/rate-limit no longer generate false positives in the js/missing-rate-limiting query.

If new alerts surface after upgrading, treat them as real findings first and dismiss only after confirming the data path cannot reach a dangerous sink.

Source: GitHub Changelog