Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/anchore/grype

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2GoPublished

    Grype has a credential disclosure vulnerability in its JSON output

    CVE-2025-65965 · GHSA-6gxw-85q2-q646

    Affected
    • Go github.com/anchore/grype >= 0.68.0, < 0.104.1
    Fixed in
    0.104.1· Vendor fix available
    Issue
    A credential disclosure vulnerability was found in Grype, affecting versions v0.68.0 through v0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file option, the registry credentials will be included unsanitized in the output file. Impact In Grype versions v0.68.0 through v0.104.0, when registry authentication is configured, those credentials can be incorrectly included in the output of a Grype scan (regardless of whether those credentials are actively being used for the current scan). Users that do not have registry authentication configured are not affected by this issue. Registry credentials can be set via the Grype configuration file (e.g. registry.auth[].username, registry.auth[].password, registry.auth[].token) or environment variables (e.g., GRYPEREGISTRYAUTHUSERNAME, GRYPEREGISTRYAUTHPASSWORD, GRYPEREGISTRYAUTHTOKEN). In order for the authentication details to be improperly included, the Grype file output format…

    Recommended action: Upgrade to 0.104.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →