The vulnerability arises from improper handling of user‑supplied inputs when the Trivy Action writes environment variables to a file and then sources that file. Because the input values are written without shell escaping, an attacker who can influence any action input can inject shell metacharacters, causing the GitHub Actions runner to execute arbitrary commands at the environment of the job. This represents a classic shell injection (CWE‑78) that can compromise secrets, access control, or the build environment.

aquasecurity:trivy-action versions 0.31.0 through 0.33.1 are affected when they are used in a GitHub Actions workflow that accepts attacker‑controlled values for any input that ends up written to trivy_envs.txt. The vulnerability is patched in 0.34.0. Workflows that do not forward untrusted data to those inputs, or that update to the patched release, are not vulnerable.

The CVSS base score of 5.9 indicates a medium impact, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires that the adversary can supply or manipulate job inputs within a GitHub Actions workflow; once the action sources the env file, the injected commands run with the permissions of the runner. While the probability of exploitation is low, the potential consequences for compromise of the runner and the build pipeline are significant.