GHSA-69fq-xp46-6x23

Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy

Unknown highest severity reported · also known as CVE-2026-33634, GO-2026-4919

1
catalog tools match this advisory
1
ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)
Yes
in the CISA KEV catalog (CVE-2026-33634, added 2026-03-26)
59.7%
EPSS for CVE-2026-33634, percentile 99

Catalog tools matching GHSA-69fq-xp46-6x23

ToolVersion scannedPackageFixed inReleased binaryDeclared in or found inDispute
kubescape
Kubernetes Security
v4.0.17github.com/aquasecurity/trivy@v0.72.0
golang
no fix listedvulnerable code in binarykubescape (release binary; govulncheck only)Dispute
upstream ranges disagree: govulncheck reports the Trivy supply-chain compromise (CVE-2026-33634, in CISA KEV) because the Go vulnerability database entry GO-2026-4919 lists every Trivy version from v0.69.4 on as affected, with no fixed version. The GitHub advisory for the same incident, GHSA-69fq-xp46-6x23, lists only v0.69.4. kubescape v4.0.17 builds in v0.72.0.

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.

Advisory sources

GitHub advisory GHSA-69fq-xp46-6x23 · NVD CVE-2026-33634 · Go vulnerability GO-2026-4919 · OSV GHSA-69fq-xp46-6x23

Grype data sources: https://pkg.go.dev/vuln/GO-2026-4919