Trivy CVE-2026-63328

Exploitation requires the victim user to install or run a Trivy plugin obtained from an untrusted source outside the official Trivy plugin index. The attacker must control the plugin manifest and craft a malicious plugin name field containing directory traversal sequences. The official Trivy plugin index is explicitly safe per vendor advisory - only third-party or attacker-distributed plugins can carry the malicious manifest. File writes are bounded to paths writable by the victim's user account; root filesystem paths and system directories are not reachable without a separate privilege escalation primitive. Trivy deployments that enforce official-index-only plugin sourcing through policy or CI/CD controls are not exploitable. CVSS PR:N indicates no system privileges are required from the attacker's perspective; CVSS UI:A (active user interaction) confirms the mandatory install action by the victim.

The CVSS 4.0 score of 6.8 (AV:L/AC:L/AT:N/PR:N/UI:A/VI:H/VA:H) accurately reflects that exploitation requires local execution and active user interaction, significantly constraining real-world attack surface compared to network-exploitable vulnerabilities. The integrity and availability impacts are both High - an attacker writing to arbitrary user-writable paths can overwrite shell configuration, SSH keys, or cron jobs, enabling subsequent privilege escalation without this CVE itself requiring additional privileges. No EPSS data was supplied, precluding probabilistic scoring; the absence of a CISA KEV listing and public exploit code further reduces urgency relative to the raw score. The decisive risk factor is whether an organization permits installation of plugins from sources outside the official Trivy plugin index, which the vendor explicitly designates as safe. For teams enforcing official-index-only plugin sourcing, practical risk is negligible. For those allowing ad-hoc or community plugin installation - including in automated CI/CD contexts where developers pull community plugins freely - this represents a meaningful supply-chain-style threat warranting prompt patching. CVSS score and real-world risk are well-aligned here: medium priority for most deployments, elevated priority for open plugin environments.

An attacker publishes a malicious Trivy plugin to a public repository with a plugin name field in the manifest containing a path traversal sequence targeting a sensitive user file, such as '../../../.ssh/authorized_keys'. After advertising the plugin as a useful scanning extension, the attacker persuades a developer or security engineer to run 'trivy plugin install' against the malicious source. On an unpatched Trivy installation, the plugin manager resolves the traversal path and writes attacker-controlled content to the victim's SSH authorized_keys, enabling subsequent remote access. No public exploit code exists at time of analysis.