A malicious actor compromised credentials and used them to publish a malicious release of Trivy version 0.69.4, force‑push 76 of 77 tags in the aquasecurity/trivy-action repository to malware, and replace all seven tags in aquasecurity/setup‑trivy with malicious commits. This attack enabled the attacker to inject unauthorized code into users’ CI pipelines and potentially exfiltrate secrets during the credential‑rotation window. The core weakness is a supply‑chain code‑injection vulnerability (CWE-506) that allows injection of malicious code through tampered CI workflow tags. The consequence is that any pipeline relying on these tags could execute attacker‑controlled code with the same permissions as the pipeline runner, leading to credential theft, data exfiltration, and further compromise of downstream systems.

Affected components include the Aquasec Trivy binary in container image version 0.69.4, the aquasecurity/trivy‑action GitHub Action versions 0.0.1 through 0.34.2 (76 of 77 tags), and the aquasecurity/setup‑trivy Action versions 0.2.0 through 0.2.5. Safe releases are Trivy 0.69.2 and 0.69.3, trivy‑action 0.35.0, and setup‑trivy 0.2.6. The CVE also lists versions 1.82.7 and 1.82.8 of the Litellm library and 4.87.1 and 4.87.2 of the Telnyx Python client as potentially affected by supply‑chain tampering, though the primary compromise centers on the Trivy ecosystem.

The vulnerability carries a CVSS score of 9.4 and an EPSS probability of 21 %, and it is listed in the CISA Known Exploited Vulnerabilities catalog, indicating that active exploitation is likely. Attackers exploited the supply‑chain path by pushing malicious tags under valid credentials; if a project pulled the vulnerable tags without pinning to a specific commit SHA, the action would run the attacker’s code. During the short period when compromised tokens were still active, the attacker could exfiltrate newly rotated secrets, granting persistent access. Detection relies on reviewing workflow runs from March 19–20, 2026 and inspecting for suspicious revisions or the presence of a tpcp‑docs repository. The attack vector is ultimately remote code execution triggered by tampered CI/CD artifacts, with widespread impact on any systems executing the compromised actions.