Skip to content
OpenAdvisories

Package · GitHub Actions

aquasecurity/trivy-action

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2026-26189 Public exploit

    Trivy Action has a script injection via sourced env file in composite action

    Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting envi…

    aquasecurity trivy-action aquasecurity/trivy-action GitHub Actions