[Bug]: Trivy scan vulns in 1.59 noble docker

[dimkin-eu]

Version

1.59

Steps to reproduce

trify scan finds such vulns

Total: 8 (HIGH: 8, CRITICAL: 0)
┌──────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │ Installed Version │                      Fixed Version                      │                           Title                           │
├──────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ minimatch (package.json) │ CVE-2026-27903 │ HIGH     │ fixed  │ 10.2.2            │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 │ minimatch: minimatch: Denial of Service due to unbounded  │
│                          │                │          │        │                   │                                                         │ recursive backtracking via crafted...                     │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27903                │
│                          ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                          │ CVE-2026-27904 │          │        │                   │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 │ minimatch: Minimatch: Denial of Service via catastrophic  │
│                          │                │          │        │                   │                                                         │ backtracking in glob expressions                          │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27904                │
│                          ├────────────────┤          │        ├───────────────────┼─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                          │ CVE-2026-26996 │          │        │ 9.0.5             │ 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 │ minimatch: minimatch: Denial of Service via specially     │
│                          │                │          │        │                   │                                                         │ crafted glob patterns                                     │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-26996                │
│                          ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                          │ CVE-2026-27903 │          │        │                   │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 │ minimatch: minimatch: Denial of Service due to unbounded  │
│                          │                │          │        │                   │                                                         │ recursive backtracking via crafted...                     │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27903                │
│                          ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                          │ CVE-2026-27904 │          │        │                   │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 │ minimatch: Minimatch: Denial of Service via catastrophic  │
│                          │                │          │        │                   │                                                         │ backtracking in glob expressions                          │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27904                │
├──────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ tar (package.json)       │ CVE-2026-23950 │          │        │ 7.5.3             │ 7.5.4                                                   │ node-tar: tar: node-tar: Arbitrary file overwrite via     │
│                          │                │          │        │                   │                                                         │ Unicode path collision race condition...                  │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-23950                │
│                          ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                          │ CVE-2026-24842 │          │        │                   │ 7.5.7                                                   │ node-tar: tar: node-tar: Arbitrary file creation via path │
│                          │                │          │        │                   │                                                         │ traversal bypass in hardlink...                           │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-24842                │
│                          ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                          │ CVE-2026-26960 │          │        │                   │ 7.5.8                                                   │ tar: node-tar: node-tar: Arbitrary file read/write via    │
│                          │                │          │        │                   │                                                         │ malicious archive hardlink creation                       │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-26960                │
└──────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────┘

Expected behavior

no security issues

Actual behavior

2 packages affected

Additional context

No response

Environment

trivy scan of image FROM mcr.microsoft.com/playwright:v1.59.0-noble

[Skn0tt]

Hi! Does Trivy tell you where it detected the package installations? I checked our main package-lock.json that we use for building the image. We don't have tar and for minimatch we're on a fixed version.

[dimkin-eu]

│ usr/lib/node_modules/pnpm/dist/node_modules/tar/package.json                     │ node-pkg │        3        │    -    │

│ usr/lib/node_modules/pnpm/dist/node_modules/minimatch/package.json               │ node-pkg │        3        │    -    │

minimatch is here

        "minimatch": "^10.2.2",

https://github.com/microsoft/playwright/blob/main/package-lock.json#L2090

[Skn0tt]

We don't explicitly install pnpm in our Dockerfile, so this is likely coming from the default npm install. We don't pin to a specific Node.js version, only specify 24, so this is apparently coming upstream from the current Node.js install.

The minimatch mention you found is in dependencies, not in the top level. If you check what it was resolved to in the top level, you'll find 10.2.4 and 3.1.5:

playwright/package-lock.json

Line 2130 in 367517d

"version": "10.2.4",

playwright/package-lock.json

Line 5845 in 367517d

"version": "3.1.5",

[Skn0tt]

Having said that, let me walk back on the claim that we use package-lock.json while building the Dockerfile - we install fresh:

playwright/utils/docker/Dockerfile.noble

Line 44 in 367517d

npm i /tmp/playwright-core.tar.gz && \

But this'll mean that the installed deps are as fresh as it gets. These trivy flags should resolve themselves on the next Docker build with a fixed pnpm.

[dimkin-eu]

so i wait for docker update, not pw 1.59.1 ?

[Skn0tt]

We publish Docker images upon release. If the next release includes a fixed PNPM, then the scan results go away. If you need your scans resolved faster, build the image yourself. Having said that, I don't see how these flags in the unused "pnpm" folder are security-critical in the context of the Playwright Docker image, so don't worry too much.

[dimkin-eu]

We enhance pw image with ffmpeg, git-lfs and some other neeeded stuff. skipped locally CVEs with .trivyignore , no worries.

[dimkin-eu]

@Skn0tt i've tried 1.59.1 today - minimatch still there :(

│ usr/lib/node_modules/npm/node_modules/minimatch/package.json                     │ node-pkg │        0        │    -    │

Total: 2 (HIGH: 2, CRITICAL: 0)
┌──────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │ Installed Version │                      Fixed Version                      │                          Title                           │
├──────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────┤
│ minimatch (package.json) │ CVE-2026-27903 │ HIGH     │ fixed  │ 10.2.2            │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 │ minimatch: minimatch: Denial of Service due to unbounded │
│                          │                │          │        │                   │                                                         │ recursive backtracking via crafted...                    │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27903               │
│                          ├────────────────┤          │        │                   ├─────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────┤
│                          │ CVE-2026-27904 │          │        │                   │ 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 │ minimatch: Minimatch: Denial of Service via catastrophic │
│                          │                │          │        │                   │                                                         │ backtracking in glob expressions                         │
│                          │                │          │        │                   │                                                         │ https://avd.aquasec.com/nvd/cve-2026-27904               │
└──────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────┘

[Skn0tt]

Now it's in npm, not pnpm. How curious! We didn't change anything on our end, so it look like the default Node 24 install still produces a build with this version. As mentioned above though, I wouldn't worry too much about this.

[dimkin-eu]

1.60 - new package :D

usr/lib/node_modules/npm/node_modules/tinyglobby/node_modules/picomatch/package- │ node-pkg │  
usr/lib/node_modules/npm/node_modules/brace-expansion/package.json               │ node-pkg │   

┌──────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬────────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                           Title                            │
├──────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼────────────────────────────────────────────────────────────┤
│ picomatch (package.json) │ CVE-2026-33671 │ HIGH     │ fixed  │ 4.0.3             │ 4.0.4, 3.0.2, 2.3.2 │ picomatch: Picomatch: Regular Expression Denial of Service │
│                          │                │          │        │                   │                     │ via crafted extglob patterns                               │
│                          │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-33671                 │
│                          │                │          │        │                   │                     │                                                            │
│ brace-expansion (package.json) │ CVE-2026-33750 │ MEDIUM   │ fixed  │ 2.0.2             │ 5.0.5, 3.0.2, 2.0.3, 1.1.13 │ brace-expansion: brace-expansion: Denial of Service via zero │
│                                │                │          │        │                   │                             │ step value in brace pattern...                               │
│                                │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33750                   │
│                                │                │          │        ├───────────────────┤                             │                                                              │
│                                │                │          │        │ 5.0.4             │                             │                                                              │
│                                │                │          │        │                   │                             │                                                              │
│                                │                │          │        │                   │                             │                                                              │
├────────────────────────────────┼────────────────┤          │        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ picomatch (package.json)       │ CVE-2026-33672 │          │        │ 4.0.3             │ 4.0.4, 3.0.2, 2.3.2         │ picomatch: Picomatch: Data integrity compromised via method  │
│                                │                │          │        │                   │                             │ injection with crafted POSIX bracket...                      │
│                                │                │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33672                   │
│                                │                │          │        │                   │                             │                                                              │
│                                │                │          │        │                   │                             │                                                              │
│                                │                │          │        │                   │                             │                                                              │
│                                │                │          │        │                   │                             │                                                              │
└────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────┘