CodeQL 2.27 runs natively on Linux ARM64 and adds a Rust query

GitHub released CodeQL 2.27.0 on 9 September. The change most teams will notice first is native Linux ARM64 support: the CLI and the CodeQL bundle are now published as ARM64 binaries in the per-platform release assets on GitHub, so scans run on the same architecture as the build. GitHub says the update deploys automatically to github.com; GitHub Enterprise Server gets it in a future release.

The release also adds new detection queries. There is a Rust security query for command-line injection, a new SQL injection sink in the PostgreSQL libpq client library for C and C++ code, and better discovery of ASP.NET Core MVC controllers. Java and Kotlin gain modelling for the Micronaut framework, and the C# analyser tracks tainted data through OData bindings. Custom-query users can now authenticate to private registries.

Why the ARM64 change is the interesting one

Native ARM64 support sounds like routine infrastructure work, and most weeks it would be. The reason it changes something today is that teams have moved workloads to Graviton, Ampere and other ARM Linux hosts in production and in CI over the last two years, and until 2.27.0 they kept a separate x86 runner running to host the CodeQL scan, because the tool ran under emulation or did not run at all.

That double-runner setup costs money, adds a build step whose failures nobody understands, and moves the scan out of the normal CI flow. Running CodeQL as an ARM64 binary on the same host that builds and tests the code fixes that. The scan sits in the pipeline where a developer already looks when a check fails.

The new queries, in one line each

The command-line injection query is the piece Rust teams should pay closest attention to. Rust code that runs an outside program through std::process::Command with a user-controlled argument is a class of bug that looks safe to a reviewer, and static queries have not covered it well until now. If your codebase runs external tools, this is worth turning on before the next release.

The libpq SQL injection sink matters mostly for C and C++ services that connect to PostgreSQL directly, which is a smaller group than the ORM users on the JVM but not a small one, and the failure is a well-known one. The Micronaut modelling and OData taint tracking cover cases that experienced users of the Java, Kotlin and C# analysers had been working around by writing their own extensions.

For an existing CodeQL user, the upgrade is not optional in the medium term because GitHub-hosted scans move automatically. For a team that had considered CodeQL and stopped because of the extra runner cost, the ARM64 change is the reason to look again.

Source

• CodeQL 2.27.0 adds support for Linux ARM64, GitHub Changelog, 9 September 2026