How would you detect if a base image has known critical CVEs before deploying?

Run an image vulnerability scanner (Trivy, Grype, or a registry's built-in scanning like ECR/Docker Scout) against the built image as a CI pipeline step, and configure the pipeline to fail the build if critical/high-severity CVEs are found above an agreed threshold.