{"id":"CVE-2026-63328","sourceIdentifier":"security-advisories@github.com","published":"2026-08-18T16:18:12.387","lastModified":"2026-10-22T22:10:00.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0."},{"lang":"es","value":"Trivy es un escáner de seguridad. Antes de la versión 0.72.0, los metadatos del manifiesto del plugin son utilizados por pkg/plugin/manager.go para construir rutas bajo ~/.trivy/plugins sin confinar los nombres de los plugins a esa raíz, permitiendo a un atacante que persuade a un usuario para instalar o ejecutar un plugin malicioso escribir el manifiesto y el binario del plugin en rutas arbitrarias donde el usuario tenga permisos de escritura, mientras que los plugins del índice oficial de plugins de Trivy no se ven afectados. Este problema está solucionado en la versión 0.72.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"aquasecurity","product":"trivy","versions":[{"version":"< 0.72.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T15:48:35.086779Z","id":"CVE-2026-63328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959","source":"security-advisories@github.com"},{"url":"https://github.com/aquasecurity/trivy/releases/tag/v0.72.0","source":"security-advisories@github.com"},{"url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw","source":"security-advisories@github.com"}]}