5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26189

CVE-2026-26189: Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes export VAR=<input> lines to trivy_envs.txt based on user-supplied inputs and subsequently sources this file in entrypoint.sh. Because input values are written without appropriate shell escaping, attacker-controlled input containing shell metacharacters (e.g., $(...), backticks, or other command substitution syntax) may be evaluated during the sourcing process. This can result in arbitrary command execution within the GitHub Actions runner context. Version 0.34.0 contains a patch for this issue. The vulnerability is exploitable when a consuming workflow passes attacker-controlled data into any action input that is written to trivy_envs.txt. Access to user input is required by the malicious actor. Workflows that do not pass attacker-controlled data into trivy-action inputs, workflows that upgrade to a patched version that properly escapes shell values or eliminates the source ./trivy_envs.txt pattern, and workflows where user input is not accessible are not affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26189

CVE-2026-26189:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aquasecurity/trivy-action	actions	>= 0.31.0, < 0.34.0	0.34.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection within the aquasecurity/trivy-action GitHub Action, introduced in commit 7aca5acc9500b463826cc47a47a65ad7d404b045. The vulnerability exists because user-supplied inputs are not properly sanitized before being written to a file that is later executed as a shell script.

The vulnerability has two main components:

The Injection Sink: In action.yaml, the shell function set_env_var_if_provided takes user inputs and writes them to a file named trivy_envs.txt. It uses the command echo "export $var_name=$input_value" >> trivy_envs.txt, which does not escape special shell characters in the $input_value. This allows an attacker to inject arbitrary shell commands into the trivy_envs.txt file.
The Execution Trigger: In entrypoint.sh, the command source ./trivy_envs.txt is used. This command reads the trivy_envs.txt file and executes its contents as a shell script. When the file contains malicious commands injected in the previous step, they are executed with the permissions of the GitHub Actions runner.

The patch, in commit bc61dc55704e2d5704760f3cdab0d09acf16e4ca, fixes the vulnerability by replacing the insecure echo command with printf 'export %s=%q\n' "$var_name" "$input_value". The %q format specifier in printf ensures that the input value is properly quoted and escaped, preventing it from being interpreted as shell commands.

During exploitation, a runtime profiler would show the entrypoint.sh script being executed, which in turn sources the malicious trivy_envs.txt file. The set_env_var_if_provided function is where the malicious payload is constructed.

Vulnerable functions

set_env_var_if_provided

action.yaml

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.