SB2026040409 - OS command injection in Aqua Security trivy-action

Description

This security bulletin contains information about 1 security vulnerability.

1) OS Command Injection (CVE-ID: CVE-2026-26189)

The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to improper neutralization of special elements used in an os command in the composite action environment variable export and sourcing logic when processing attacker-controlled action inputs into trivy_envs.txt. A remote privileged user can supply input containing shell metacharacters to execute arbitrary commands.

The issue affects workflows that pass attacker-controlled data into action inputs that are written to trivy_envs.txt and then sourced by entrypoint.sh, resulting in command execution in the GitHub Actions runner context.

Remediation

Install update from vendor's website.

References

• https://github.com/aquasecurity/trivy-action/security/advisories/GHSA-9p44-j4g5-cfx5
• https://github.com/advisories/GHSA-9p44-j4g5-cfx5