Vulnerability · Published Nov 25, 2025 · Assigned by GitHub_M

CVE-2025-65965Grype has a credential disclosure vulnerability in Grype JSON output

High 8.2

In plain English

A high-severity security flaw in grype from anchore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.2%top 94.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	grype	0.104.1-r0	ALPINE-CVE-2025-65965
Alpine:v3.24	grype	0.104.1-r0	ALPINE-CVE-2025-65965
Go	github.com/anchore/grype	0.104.1	GO-2025-4160
Go	github.com/anchore/grype	0.104.1	GHSA-6gxw-85q2-q646

Affected products (as reported)

Vendor	Product	Versions
anchore	grype	>= 0.68.0, < 0.104.1

Weakness: CWE-212 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646 x_refsource_CONFIRM
https://github.com/anchore/grype/pull/3068 x_refsource_MISC
https://github.com/anchore/grype/commit/39f7fa17af2739cafe9b27176d4a68f7c05f21c1 x_refsource_MISC