{"id":"CVE-2026-63328","title":"Trivy is a security scanner","summary":"Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to i…","severity":"medium","cwe":["CWE-22"],"vendor":"aquasecurity","product":"github.com/aquasecurity/trivy","affected":["github.com/aquasecurity/trivy < 0.72.0"],"patched":["github.com/aquasecurity/trivy 0.72.0"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63328","references":[{"url":"https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959","label":"security-advisories@github.com"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.72.0","label":"security-advisories@github.com"},{"url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-8rc5-4fr6-64pw"}],"tags":["nvd","ghsa","go"],"epss":0.0019,"epssPercentile":0.07614,"aliases":["GHSA-8rc5-4fr6-64pw"],"ecosystem":"go","ingestedAt":"2026-08-18T17:20:36.694Z","slug":"CVE-2026-63328","body":"## Overview\n\nTrivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63328)\n\nAffected packages:\n\n- `github.com/aquasecurity/trivy < 0.72.0`\n\nPatched in:\n\n- `github.com/aquasecurity/trivy 0.72.0`\n\nSource: https://github.com/advisories/GHSA-8rc5-4fr6-64pw","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}