CVE-2026-28353

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.51%
EPSS Percentile: 43.57%
CISA KEV: Not listed

Description

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive information. Users using the affected artifact are advised to immediately remove it and rotate environment secrets. The malicious artifact has been removed from the marketplace. No other affected artifacts have been identified.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 06-Mar-2026 03:16
Last Modified: 17-Jun-2026 17:28
EPSS Date: 2026-11-08
CWE: CWE-506

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

aquasecurity · trivy-vscode-extension Source: CNA · [email protected]
Default status: unknown

= 1.8.12 — affected

References

[email protected]

Last enrichment sync: 09-Nov-2026 14:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

attack using hackerbot-claw exploited GitHub Actions to compromise Aqua Security’s Trivy extension (CVE-2026-28353), leading to removals and recommendations to rotate keys and audit CI workflows. Five Malicious Rust Crates and AI Bot Target CI/CD Secrets

People (2)

MITRE ATT&CK (4)

Vendors (2)

Products (10)

Tools (1)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.