Trivy Vulnerability Scanner OpenVSX Extension Malicious Code Injection Vulnerability

A vulnerability has been identified in the Trivy Vulnerability Scanner VS Code extension, specifically in version 1.8.12, which was distributed through the OpenVSX marketplace. This version was compromised and included malicious code intended to exploit the local AI coding agent, allowing for the collection and exfiltration of sensitive information. Users of this affected version are recommended to remove it immediately and rotate their environment secrets. The malicious extension has been removed from the marketplace, and no other affected versions have been found.

Impact

The vulnerability allows for the unauthorized collection and exfiltration of sensitive information by leveraging the local AI coding agent.

Remediation

Users are advised to remove the affected version of the Trivy VSCode Extension and rotate their environment secrets.