CVE-2026-28353
Malicious Code Injection in Trivy VSCode Extension
Publication date: 2026-03-05
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| aquasecurity | trivy_vscode_extension | to 1.8.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-506 | The product contains code that appears to be malicious in nature. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-28353 is a critical security vulnerability found in the Trivy VSCode Extension version 1.8.12, which was distributed via the OpenVSX marketplace.'}, {'type': 'paragraph', 'content': "This version of the extension was compromised and contained malicious code designed to exploit a local AI coding agent on the user's system."}, {'type': 'paragraph', 'content': 'The malicious code collects and exfiltrates sensitive information from users without their consent.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized collection and exfiltration of sensitive information from your environment.
If you use the affected Trivy VSCode Extension version 1.8.12, your environment secrets and other sensitive data could be exposed to attackers.
Users are advised to immediately uninstall the compromised extension and rotate any environment secrets to mitigate the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
Users of the affected Trivy VSCode Extension version 1.8.12 are strongly advised to immediately uninstall the extension.
Additionally, it is critical to rotate any environment secrets to mitigate potential data exposure caused by the malicious code embedded in the compromised extension.
The malicious extension has been removed from the OpenVSX marketplace, and no other affected artifacts have been identified.