Request to Discuss Weaknesses/Vulnerabilities with Affected Products

[squinky86]

Description

I had mentioned implementations that use Trivy in an insecure and/or dangerous way in https://github.com/aquasecurity/trivy/security/advisories/GHSA-jf88-287j-qwvv and https://github.com/aquasecurity/trivy/security/advisories/GHSA-w2p7-mh9r-rp32

In those discussions, I listed several CI/CD frameworks that are affected and requested October 5 as the day I was hoping to hear that I could speak to them freely. As there have been no discussions or follow-ups and the security discussions have been closed, am I allowed to disclose these weaknesses to the affected products without getting in trouble?

Desired Behavior

Fixes so that the default behavior is secure

Actual Behavior

n/a

Reproduction Steps

n/a

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

n/a

Operating System

linux

Version

0.75.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hi @squinky86,

We don't need you to hold off on publication — that's up to you.

Both reports remain closed as out of scope: Trivy treats its configuration as trusted.
The trust model and the precautions for scanning untrusted content are documented here and here.

We also consider the trivy-action report out of scope: in pull_request workflows from forks, secrets are withheld and GITHUB_TOKEN is read-only, so no impact beyond the PR job's existing permissions has been shown.

If you publish, please accurately reflect our assessment.

Regards, Dmitriy

[squinky86]

Hi @DmitriyLewen,

Thank you for clarifying Aqua’s position and confirming that publication did not need to be delayed. The two disclosures are now available:

PVD-20260906-D960: Trivy Implicit Configuration Allows Arbitrary File Overwrite and Second-Stage Code Execution

PVD-20260906-3982: Trivy Implicit Rego Policies Can Disclose Secrets and Make Arbitrary HTTP Requests

Both accurately reflect Aqua’s assessment that Trivy configuration and selected policies are trusted. I have kept integration-specific findings out of the public reports and will contact the relevant maintainers privately as aforementioned in the GHSA discussions, where I do encourage Aqua to ensure that Aqua-maintained integrations implement this newly-documented trust boundary by default.

Trivy 0.75 now documents the precautions for scanning untrusted content and supports explicitly disabling automatic configuration loading with --config="". Integrations scanning an untrusted checkout should either select an absolute, integration-owned configuration outside that checkout or explicitly disable project-local configuration and load only trusted policies and templates. Repository configuration can remain available as an intentional opt-in when the caller means to trust it.

Thank you again for the clear response and for the documentation and v0.75 changes.