Trivy ecosystem supply chain was briefly compromised
Affected range
SEMVER: introduced 0.69.4github.com/aquasecurity/trivy
Go package metadata, published advisories, affected versions, and known-exploitation evidence.
Go latest v0.74.0
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
v0.74.0
Published advisories match this version
2
Known exploitation
CISA KEV match
CVE-2026-33634
3
Highest advisory severity
Critical
5 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-mcj4-mphf-j9ff high
Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts
Affected range
SEMVER: introduced 0; fixed 0.71.1Fixed versions: 0.71.1
GHSA-q3fv-x8vg-qqm4 high
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Affected range
SEMVER: introduced 0; fixed 0.71.0Fixed versions: 0.71.0
GHSA-8rc5-4fr6-64pw moderate
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
Affected range
SEMVER: introduced 0; fixed 0.72.0Fixed versions: 0.72.0
GHSA-xcq4-m2r3-cmrj moderate
Trivy possibly leaks registry credential when scanning images from malicious registries
Affected range
SEMVER: introduced 0; fixed 0.51.2Fixed versions: 0.51.2