CVE-2026-63328: trivy < 0.72.0

Affected technology

trivy · < 0.72.0
aquasecurity

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Active user interaction

What an attacker can do

The source says prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality impact as none; integrity and availability impact as high.