Aqua Security Trivy Critical Vulnerability (CVSS 9.9)

CERT-Bund published a critical security advisory for a remote code execution vulnerability in Aqua Security Trivy affecting versions 0.69.4 and below (setup-trivy <0.2.6, trivy-action <0.35.0, Container Image 0.69.5 and 0.69.6). The vulnerability achieves the maximum CVSS Base Score of 9.9, indicating critical severity, with a Temporal Score of 9.5. All major operating systems including Linux, macOS, UNIX, and Windows are affected.

Organizations using Aqua Security Trivy for container image scanning must immediately identify affected installations across their infrastructure and apply available mitigation measures. Security teams should prioritize patching given the remote attack vector and potential for complete system compromise. The advisory confirms mitigation is available and organizations should monitor for subsequent patches to address this vulnerability.