CVE-2025-65965
Description
Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.
How to fix
- github.com/anchore/grype0.104.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/anchore/grypeGo | 0.68.0 ≤ v < 0.104.1 | 0.104.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.