In version 1.8.12 of the Aqua Security Trivy VS Code Extension, code was added that exploits the local AI coding agent to collect and exfiltrate sensitive information. The injected code represents a code injection flaw (CWE-506) that allows an attacker to execute arbitrary logic on the host system where the extension runs. The impact is a compromise of confidentiality and integrity of environment secrets and other data that the extension may access.

Aqua Security Trivy VS Code Extension, version 1.8.12, distributed through the OpenVSX marketplace, is the only affected variant; no other versions or artifacts have been identified as compromised.

The vulnerability scores a CVSS of 10, indicating critical severity, yet the EPSS probability is reported as less than 1%, implying low likelihood of exploitation at the moment. The extension runs locally within the VS Code environment, so the attack vector is an end‑user installing or updating the plugin. Since the malicious artifact has already been removed from the marketplace, the remaining risk revolves around devices that still have the compromised extension installed or have cached remnants. The vulnerability is not listed in the CISA KEV catalog, but its high impact warrants immediate attention.