Skip to content
OpenAdvisories

Package · GitHub Actions

aquasecurity/trivy-action

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Medium 5.9
    CVE-2026-26189 Public exploit

    Trivy Action has a script injection via sourced env file in composite action

    Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting envi…

    aquasecurity trivy-action aquasecurity/trivy-action GitHub Actions