CVE-2026-63328
Fixed in a distro release EPSS <1%CVSS 6.8
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.
Products: aquasecurity trivy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/aquasecurity/trivy | 0.72.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cloudbeat-8.17 | no fix |
| Chainguard | cloudbeat-8.19 | 8.19.20-r3 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r28 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r29 |
| Chainguard | cloudbeat-9.3 | 9.3.8-r4 |
| Chainguard | cloudbeat-9.4 | 9.4.5-r3 |
| Chainguard | cloudbeat-9.5 | 9.5.1-r2 |
| Chainguard | cloudbeat-fips-8.17 | no fix |
| Chainguard | cloudbeat-fips-8.19 | 8.19.20-r2 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r28 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.8-r5 |
| Chainguard | cloudbeat-fips-9.4 | 9.4.5-r2 |
| Chainguard | cloudbeat-fips-9.5 | 9.5.1-r2 |
| Chainguard | kubescape | 4.0.15-r2 |
| Chainguard | kubescape-server | 4.0.15-r2 |
| Chainguard | kubescape-server-downloader | 4.0.15-r2 |
| Chainguard | kubescape-server-fips | 4.0.15-r2 |
| Chainguard | kubescape-server-fips-downloader | 4.0.15-r2 |
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| Wolfi | kubescape | 4.0.15-r2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |