Grype: Vulnerability scanner for container images and filesystems
Detect vulnerabilities in container images and filesystems.
Learn more about grype
Grype is a command-line vulnerability scanner written in Go that analyzes container images and filesystem contents to detect security vulnerabilities. It works by identifying installed packages across multiple package managers and operating systems, then cross-referencing them against vulnerability databases. The tool supports a wide range of package ecosystems including Alpine, Debian, Ubuntu, and language-specific managers like npm, pip, and Maven. Grype is commonly deployed in CI/CD pipelines, container registries, and local development environments to identify vulnerabilities before deployment.
Multi-ecosystem support
Detects vulnerabilities across 12+ operating system distributions and 7+ language-specific package managers in a single scan, providing comprehensive coverage for heterogeneous container environments.
OpenVEX integration
Supports OpenVEX format for filtering and augmenting scan results, allowing teams to incorporate vulnerability attestations and custom metadata into scanning workflows.
Filesystem and image scanning
Analyzes both extracted container images and local filesystems without requiring Docker daemon access, enabling vulnerability assessment in restricted environments and CI/CD systems.
package main
import (
"github.com/anchore/grype/grype"
"github.com/anchore/grype/grype/presenter/models"
)
func scanImage() {
results, err := grype.ScanImage("alpine:latest")
if err != nil {
panic(err)
}
for _, match := range results.Matches {
println(match.Vulnerability.ID, match.Artifact.Name)
}
}Adds support for hyphens in version strings and honors the rpmmod PURL qualifier for RPM package matching.
- –Version strings containing hyphens are now parsed correctly during vulnerability matching.
- –RPM packages with the rpmmod PURL qualifier are now matched according to that qualifier.
Adds Alma Linux–specific advisory matching and fixes CPE vulnerability detection for Bitnami packages.
- –Grype now queries Alma Linux advisories directly when scanning Alma-based images instead of relying on RHEL data.
- –Bitnami packages with CPEs are now correctly matched against CPE-based vulnerability feeds.
Fixes a panic when scanning images with certain Java dependencies introduced in v0.101.0.
- –Upgrade immediately if running v0.101.0 to avoid crashes on Java dependency scans.
- –No configuration changes required; patch resolves panic error without breaking compatibility.
Top in Security
Related Repositories
Discover similar tools and frameworks used by developers
nuclei
Template-based multi-protocol security scanner for CI/CD pipelines.
semgrep
Pattern-based code scanner for 30+ languages.
ghidra
NSA's open-source tool for analyzing compiled binaries.
gitleaks
Regex-based secret scanner for git repositories.
httpx
Fast HTTP probing with response metadata extraction.