---
id: CVE-2026-63328
title: Trivy is a security scanner
summary: >-
  Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used
  by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without
  confining plugin names to that root, allowing an attacker who persuades a user
  to i…
severity: medium
cwe:
  - CWE-22
vendor: aquasecurity
product: github.com/aquasecurity/trivy
affected:
  - github.com/aquasecurity/trivy < 0.72.0
patched:
  - github.com/aquasecurity/trivy 0.72.0
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63328'
references:
  - url: >-
      https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
    label: security-advisories@github.com
  - url: 'https://github.com/aquasecurity/trivy/releases/tag/v0.72.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8rc5-4fr6-64pw'
tags:
  - nvd
  - ghsa
  - go
epss: 0.0019
epssPercentile: 0.07668
aliases:
  - GHSA-8rc5-4fr6-64pw
ecosystem: go
ingestedAt: '2026-08-18T17:20:36.694Z'
---

## Overview

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63328)

Affected packages:

- `github.com/aquasecurity/trivy < 0.72.0`

Patched in:

- `github.com/aquasecurity/trivy 0.72.0`

Source: https://github.com/advisories/GHSA-8rc5-4fr6-64pw