CVE-2026-26189

score

0.1

cvss

5.9

epss

2.3% ▲0.2

published

2026-02-19

kev added

—

first seen

2026-10-21

aquasecurity Trivy Action 0.31.0 through 0.33.1 contains a command injection caused by improper handling of action inputs when exporting environment variables in trivy_envs.txt, letting attackers execute arbitrary commands in GitHub Actions runner, exploit requires attacker-controlled input to action inputs.