Security vulnerabilities and automated fixes for trivy issues
3 posts found
The `ensureTrivy()` function fetched the Trivy vulnerability scanner from GitHub releases without verifying its integrity, exposing applications to supply-chain attacks. An attacker in a MITM position or a compromised CDN could substitute a malicious binary that executes with the application's privileges. The fix adds cryptographic verification using SHA256 checksums published alongside each release.
CVE-2026-53951 is a high-severity path traversal vulnerability in Copier 9.15.0 that allowed attackers to bypass trust-prefix checks and execute tasks without user confirmation. Upgrading to Copier 9.15.2 eliminates this attack vector by properly validating file paths before task execution.
CVE-2026-9277 is a critical command injection vulnerability in shell-quote 1.8.3 that allows attackers to execute arbitrary code through unescaped line terminators. The fix upgrades to version 1.9.0, which properly escapes these characters and prevents shell command manipulation.