Definition
CodeQL is GitHub’s semantic static analysis engine powering GitHub Advanced Security code scanning. Uses taint tracking and data-flow analysis to detect vulnerabilities across multiple languages in CI/CD pipelines.
Key Points
-
2026-07-20: Powers deterministic side of github-code-quality GA (github-code-quality-ga)
-
2026-07-08: CodeQL 2.26.0 adds
js/system-prompt-injection— first mainstream SAST query for AI system prompt injection in JS/TS (2026-07-12-codeql-2-26-github-changelog) -
Covers openai, anthropic, and Google GenAI SDK sinks; severity 7.8 (CWE-1427)
-
Auto-deploys to repos with default CodeQL code scanning on github.com
-
Gaps: Python not covered in 2.26.0; indirect prompt injection and tool-description injection partially covered