Update module github.com/aquasecurity/trivy to v0.72.0 [SECURITY] - #576

Details

Summary

When Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer.

Affected configurations

Exploitation requires the attacker to place a crafted .tgz file in a location that Trivy will scan as a Helm chart. This applies to the following scan targets:

Realistic scenarios include:

• A CI pipeline that runs trivy config . on a repository where a contributor can submit a pull request containing a crafted chart archive.
• A pipeline that scans a container image with --scanners misconf, whose build context includes untrusted .tgz files.

Impact

An attacker who satisfies the conditions above can exhaust all available memory on the host running Trivy. The OS OOM killer will terminate the Trivy process and may affect other processes sharing the same host or CI runner.

The practical impact in CI environments is denial of service: the scan fails, the pipeline is blocked, and repeated submissions re-trigger the same condition. Cloud CI runners may also incur additional costs for consumed resources.

There is no impact on confidentiality or integrity of the scanned system.

Patches

Fixed in Trivy v0.71.0 (#​10718). The custom tar unpacker was replaced with archive.LoadArchiveFiles from the official helm.sh/helm/v4 SDK, which enforces per-entry and total size limits and validates archive structure. Users should upgrade to v0.71.0 or later.

Workarounds

If upgrading is not immediately possible:

• Set a memory limit (cgroup/container) on the Trivy process to bound the blast radius.
• Use --skip-dirs to exclude directories containing untrusted Helm chart archives from the scan.
• Avoid scanning repositories or images with untrusted .tgz files.

Credits

Reported by @​jamesgol.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4
• https://nvd.nist.gov/vuln/detail/CVE-2026-54448
• https://github.com/aquasecurity/trivy/pull/10718
• https://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4
• https://github.com/aquasecurity/trivy
• https://github.com/aquasecurity/trivy/releases/tag/v0.71.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy

Severity

Unknown

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4
• https://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4
• https://github.com/aquasecurity/trivy/pull/10718
• https://github.com/aquasecurity/trivy/releases/tag/v0.71.0

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

Summary

When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem.

Affected configurations

Exploitation requires the attacker to direct Trivy at an attacker-controlled OCI artifact via one of the following inputs:

Realistic scenarios in which an attacker may influence these inputs include a copy-pasted command or documentation snippet pointing to an untrusted mirror, or a third-party mirror that turns out to be hostile.

Trivy's default configuration, which downloads these artifacts from Aqua-operated repositories, is not affected. The risk applies only when one of the inputs above is overridden to download a different artifact.

Impact

An attacker who satisfies the conditions above can overwrite or create arbitrary files on the host filesystem within the privilege boundary of the user running Trivy. The vulnerability does not grant any privileges beyond what that user already has.

The practical impact depends on the deployment. In environments where the running user can overwrite files such as SSH authorized_keys, shell startup files, cron entries, or binaries on PATH, the file write may be leveraged to achieve code execution as that user. In more restricted deployments, the impact is bounded to the user's writable scope but may still allow tampering with scan results, build artifacts, or other files consumed by subsequent steps in the same pipeline.

Patches

Fixed in Trivy 0.71.1. Users should upgrade to that release or later.

Workarounds

If upgrading is not immediately possible, do not download Trivy artifacts (vulnerability database, Java database, misconfiguration checks bundle, modules, etc.) from OCI repositories you do not operate or trust.

Credits

Reported by @​ikkebr.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff
• https://nvd.nist.gov/vuln/detail/CVE-2026-55092
• https://github.com/aquasecurity/trivy/commit/39e0b132260c60d59fa746c3f6dd10374b0ff6e4
• https://github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31
• https://github.com/aquasecurity/trivy
• https://github.com/aquasecurity/trivy/releases/tag/v0.71.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy

Severity

Unknown

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff
• https://nvd.nist.gov/vuln/detail/CVE-2026-55092
• https://github.com/aquasecurity/trivy/commit/39e0b132260c60d59fa746c3f6dd10374b0ff6e4
• https://github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31
• https://github.com/aquasecurity/trivy/releases/tag/v0.71.1

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

Summary

Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root (~/.trivy/plugins). A crafted plugin can cause Trivy to write its files (the manifest and the downloaded plugin binary) outside the plugin root, to an arbitrary location writable by the user running Trivy.

Plugins are third-party binaries that Trivy downloads and executes, so Trivy's documentation already advises installing only plugins you trust. This issue does not change that trust boundary: exploitation requires the user to install a malicious plugin in the first place.

Affected configurations

The vulnerability is triggered only when a user installs an attacker-controlled plugin, for example via trivy plugin install <SOURCE> or trivy plugin run <SOURCE>. An attacker has to trick a user into installing a plugin they crafted, for instance by publishing it or by getting a malicious source pasted into a command or documentation snippet.

Plugins distributed through the official Trivy plugin index are not affected.

Impact

A user who installs a malicious plugin can have files written outside the plugin root, to any location writable by the user running Trivy. The vulnerability does not grant any privileges beyond what that user already has.

Patches

Fixed in Trivy 0.72.0. Users should upgrade to that release or later.

Workarounds

Only install Trivy plugins from sources you trust. Plugins from the official Trivy plugin index are safe. See the plugin documentation for details.

Credits

Reported by @​fatihhcelik.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy

Severity

Unknown

References

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-8rc5-4fr6-64pw
• https://github.com/aquasecurity/trivy/commit/d4213d7735c74e57f06c02ccb39ebca67abc7959
• https://github.com/aquasecurity/trivy/releases/tag/v0.72.0

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).