CyberRota Analysis
AI-GeneratedTrivy versions prior to 0.72.0 are vulnerable due to improper handling of plugin manifest metadata, enabling attackers to exploit this flaw by persuading users to install malicious plugins that can write to arbitrary user-writable paths. This could lead to unauthorized file modifications or execution of malicious code on the affected systems. Organizations using Trivy for security scanning should prioritize upgrading to version 0.72.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.