Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-28353 is a critical security vulnerability found in the Trivy VSCode Extension version 1.8.12, which was distributed via the OpenVSX marketplace.'}, {'type': 'paragraph', 'content': "This version of the extension was compromised and contained malicious code designed to exploit a local AI coding agent on the user's system."}, {'type': 'paragraph', 'content': 'The malicious code collects and exfiltrates sensitive information from users without their consent.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized collection and exfiltration of sensitive information from your environment.

If you use the affected Trivy VSCode Extension version 1.8.12, your environment secrets and other sensitive data could be exposed to attackers.

Users are advised to immediately uninstall the compromised extension and rotate any environment secrets to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

Users of the affected Trivy VSCode Extension version 1.8.12 are strongly advised to immediately uninstall the extension.

Additionally, it is critical to rotate any environment secrets to mitigate potential data exposure caused by the malicious code embedded in the compromised extension.

The malicious extension has been removed from the OpenVSX marketplace, and no other affected artifacts have been identified.

Useful 0 Not Useful 0