CVE-2025-65965

Name of the Vulnerable Software and Affected Versions Grype versions 0.68.0 through 0.104.0

Description Grype, a vulnerability scanner for container images and filesystems, contains a flaw where registry credentials can be improperly included in the output of a scan. This occurs when registry authentication is configured and the output is written to a file using the --file or --output json=<file> options. Credentials are set via the Grype configuration file or environment variables such as GRYPE REGISTRY AUTH USERNAME. The issue is also potentially triggered by a malformed Grype Template that includes the Descriptor.Registry.Auth fields.

Recommendations Versions 0.68.0 through 0.104.0: Redirect standard output to a file instead of using the --file or --output options. For example, use grype --output json alpine:latest > test.json instead of grype --output json=test.json alpine:latest.