CodeQL 2.27 runs natively on Linux ARM64 and adds a Rust command-injection query

GitHub released CodeQL 2.27.0 on 9 September. The change most teams will notice first is native Linux ARM64 support: the CLI and the CodeQL bundle now ship as ARM64 binaries in the per-platform release assets on GitHub, so scans run on the same architecture as the build. GitHub says the update deploys automatically to github.com; GitHub Enterprise Server picks it up in a future release.

The release also adds new detection queries. There is a Rust security query for command-line injection, a new SQL injection sink in the PostgreSQL libpq client library for C and C++ code, and better discovery of ASP.NET Core MVC controllers. Java and Kotlin gain modelling for the Micronaut framework, and the C# analyser tracks tainted data through OData bindings. Custom-query users can now authenticate to private registries.

Why the ARM64 line is the interesting one

Native ARM64 support sounds like plumbing, and most weeks it would be. The reason it changes something today is that teams have moved workloads to Graviton, Ampere and other ARM Linux hosts in production and in CI over the last two years, and until 2.27.0 they kept a separate x86 runner alive to host the CodeQL scan, because the tool ran under emulation or did not run at all.

That double-runner setup costs money, adds a build step whose failures nobody understands, and pushes the scan out of the natural CI path. Running CodeQL as an ARM64 binary on the same host that builds and tests the code closes that gap. The scan sits in the pipeline where a developer already looks when a check fails.

The new queries, in one line each

The command-line injection query is the piece Rust teams should pay closest attention to. Rust code that shells out through std::process::Command with a user-controlled argument is a class of bug that reads as safe to a reviewer, and static queries have not covered it well until now. If your codebase runs external tools, this is worth turning on before the next release train.

The libpq SQL injection sink matters mostly for C and C++ services that speak to PostgreSQL directly, which is a smaller population than the ORM users on the JVM but not a small one, and the failure mode is textbook. The Micronaut modelling and OData taint tracking fill gaps that experienced users of the Java, Kotlin and C# analysers had been working around by writing their own extensions.

For an existing CodeQL user, the upgrade is not optional in the medium term because GitHub-hosted scans move automatically. For a team that had considered CodeQL and stopped at the runner tax, the ARM64 line is the reason to look again.

Source

• CodeQL 2.27.0 adds support for Linux ARM64, GitHub Changelog, 9 September 2026