CVE-2026-63328
Description
A flaw was found in Trivy, a security scanner. The plugin manager does not properly confine plugin names to their designated root directory. This allows an attacker, by persuading a user to install or run a malicious plugin, to write the plugin manifest and binary to arbitrary user-writable paths. This could lead to unauthorized file modification on the system.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires active user interaction to install an untrusted third-party plugin, and file write actions remain limited to the operating system permissions of the executing user account. Standard CLI scanning operations do not require or automatically fetch external plugins, leaving automated CI/CD and container inspection workflows unimpacted. Additionally, plugins distributed through the official Trivy plugin index are unaffected.
Mitigation
Avoid installing or executing Trivy plugins from untrusted sources. Limit plugin usage to verified plugins from the official Trivy plugin index, or refrain from using third-party plugins in automated scanning pipelines. Running scans within an isolated container with read-only filesystem mounts prevents unauthorized file creation outside expected directories.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.6 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
