CVE-2025-65965 - CVE House
Back to Database
Status published High CVE-2025-65965

Grype has a credential disclosure vulnerability in Grype JSON output

Vulnerability Description

Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65965

Credits & Attribution

No credits recorded in the NVD database.

References

More from anchore

View All →
CVE-2024-24579
Tar path traversal in stereoscope when processing OCI tar archives
Medium 5.3
CVE-2023-24827
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
Medium 6.5
CVE-2020-11075
Shell Escape in Anchore Engine
High 7.7
CVE-2018-1999033
An exposure of sensitive information vulnerability exists in Jenkins Anchore...
Medium 6.5

Affected Vendor

Affected Software

grype
Vulnerable Versions:
>= 0.68.0, < 0.104.1

Timeline

Official Publish: November 25th, 2025
Last Modified: November 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-212

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.