trivy-action vulnerabilities

2 known vulnerabilities in trivy-action from Aquasecurity. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Aquasecurity Trivy Embedded Malicious Code Exploited

  CVE-2026-33634Mar 23, 2026AquasecurityEPSS 61.5%

  Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in

• 8.1 High severity

  trivy-action: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-26189Feb 19, 2026AquasecurityEPSS 1.51%

  Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting envir