Read the docs
TI-2026-22633 Aliases CVE-2026-28353

Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

Priority MEDIUM 49CWE-506Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-506.

Summary

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive information. Users using the affected artifact are advised to immediately remove it and rotate environment secrets. The malicious artifact has been removed from the marketplace. No other affected artifacts have been identified.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aquasecuritytrivy-vscode-extension= 1.8.12—No fix listedCNA
  • trivy-vscode-extension VendorAquasecurity Affected = 1.8.12 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28353

References

Other 1

  • TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-39311 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser CVSS 4.0MEDIUM 6.9
  • TI-2026-21180 Trivy Action has a script injection via sourced env file in composite action CVSS 3.1HIGH 8.1
  • TI-2026-39796 Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts CVSS 4.0HIGH 7.0
  • TI-2026-45161 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write CVSS 4.0MEDIUM 6.8
  • TI-2024-23265 Trivy possibly leaks registry credential when scanning images from malicious registries CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences