Grype: Vulnerability scanner for container images and filesystems
Detect vulnerabilities in container images and filesystems.
Learn more about Grype
Grype is a command-line vulnerability scanner written in Go that analyzes container images and filesystem contents to detect security vulnerabilities. It works by identifying installed packages across multiple package managers and operating systems, then cross-referencing them against vulnerability databases. The tool supports a wide range of package ecosystems including Alpine, Debian, Ubuntu, and language-specific managers like npm, pip, and Maven. Grype is commonly deployed in CI/CD pipelines, container registries, and local development environments to identify vulnerabilities before deployment.
Multi-ecosystem support
Detects vulnerabilities across 12+ operating system distributions and 7+ language-specific package managers in a single scan, providing comprehensive coverage for heterogeneous container environments.
OpenVEX integration
Supports OpenVEX format for filtering and augmenting scan results, allowing teams to incorporate vulnerability attestations and custom metadata into scanning workflows.
Filesystem and image scanning
Analyzes both extracted container images and local filesystems without requiring Docker daemon access, enabling vulnerability assessment in restricted environments and CI/CD systems.
package main
import (
"github.com/anchore/grype/grype"
"github.com/anchore/grype/grype/presenter/models"
)
func scanImage() {
results, err := grype.ScanImage("alpine:latest")
if err != nil {
panic(err)
}
for _, match := range results.Matches {
println(match.Vulnerability.ID, match.Artifact.Name)
}
}Adds context cancellation support during vulnerability matching operations.
- –support context cancellation while finding vuln matches
Adds SecureOS distro support, Erlang/Elixir hex matcher, and fixes VEX document registry matching.
- –Add secureos distro
- –add hex matcher for Erlang/Elixir ecosystem
- –disable version fallback in EOL query
- –VEX documents with docker.io registry reference not matching, require index.docker.io instead
Adds EOL distro warnings, configurable epoch handling, and Scientific Linux support.
- –warn about packages from EOL distros
- –make it configurable what grype assumes when incoming package to grype is missing dpkg/RPM epoch
- –RHEL EUS: `--only-fixed` should filter out matches are not fixed in the current EUS version
- –support scientific linux
Related Repositories
Discover similar tools and frameworks used by developers
PentestGPT
AI-assisted Python framework for automated security testing.
Ghidra
NSA's open-source tool for analyzing compiled binaries.
Nuclei
Template-based multi-protocol security scanner for CI/CD pipelines.
WhatWeb
Ruby web scanner that identifies technologies and frameworks using 1800+ detection plugins.
Gitleaks
Regex-based secret scanner for git repositories.