cve.bz

CVE-2026-63328

6.8 mediumEPSS 0.2%

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

CVSS 4.0
6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-25)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8rc5-4fr6-64pwGogithub.com/aquasecurity/trivy<0.72.00.72.0
GO-2026-6250Gogithub.com/aquasecurity/trivy<0.72.00.72.0

References

Check your stackJSON