Description
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| LiteLLM | BerriAI / LiteLLM | >= 1.82.7, <= 1.82.8 | affected |
| setup-trivy | aquasecurity / setup-trivy | < 0.2.6 | affected |
| telnyx | team-telnyx / telnyx | >= 4.87.1, <= 4.87.2 | affected |
| trivy | aquasecurity / trivy | = 0.69.4 | affected |
| trivy-action | aquasecurity / trivy-action | < 0.35.0 | affected |