A medium-severity vulnerability affecting github.com/aquasecurity/trivy versions < 0.72.0, identified as CVE-2026-63328 with a CVSS score of 6.8, affects the Trivy Plugin Manager's ability to fully validate metadata from plugins' manifests before using it to construct filesystem paths under the plugin root. This allows an attacker-controlled plugin to cause Trivy to write its files outside the plugin root to an arbitrary location writable by the user running Trivy, without granting any privileges beyond what that user already has. The vulnerability is triggered when a user installs a malicious plugin via trivy plugin install or trivy plugin run, and can be mitigated by only installing plugins from trusted sources.
We recommend you to update Trivy to version 0.72.0.[/subscribe_to_unlock_form]
A medium-severity vulnerability affecting github.com/aquasecurity/trivy versions < 0.72.0, identified as CVE-2026-63328 with a CVSS score of 6.8, affects the Trivy Plugin Manager's ability to fully validate metadata from plugins' manifests before using it to construct filesystem paths under the plugin root. This allows an attacker-controlled plugin to cause Trivy to write its files outside the plugin root to an arbitrary location writable by the user running Trivy, without granting any privileges beyond what that user already has. The vulnerability is triggered when a user installs a malicious plugin via trivy plugin install or trivy plugin run, and can be mitigated by only installing plugins from trusted sources.
We recommend you to update Trivy to version 0.72.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]