Aquasecurity vulnerabilities
We track 4 vulnerabilities in Aquasecurity products across 4 products. 4 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on June 25, 2026.
Latest Aquasecurity vulnerabilities
- 7.5 High severity
trivy: Improper Limitation of a Pathname to a Restricted Directory
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacke
- 8.8 High severity
Aquasecurity Trivy Embedded Malicious Code Exploited
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in
- 10.0 Critical severity
trivy-vscode-extension: Embedded Malicious Code
Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent
- 8.1 High severity
trivy-action: Improper Neutralization of Special Elements used in an OS Command
Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting envir