CVE-2025-65965 Grype has a credential disclosure vulnerability in Grype JSON output
Grype leaks registry credentials in JSON output files when specific output options are used, exposing sensitive authentication data to anyone with file access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65965?
CVE-2025-65965 is a high-severity vulnerability in anchore grype, published on 25 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.
Weakness: CWE-212
Which versions are affected by CVE-2025-65965?
3 open source packages ship an affected version, including github.com/anchore/grype.
| Package | Affected | Fixed in |
|---|---|---|
github.com/anchore/grype Go | From 0.68.0 | 0.104.1 |
github.com/anchore/grype Go | From 0.68.0 | 0.104.1 |
github.com/anchore/grype Go | From 0.68.0 | 0.104.1 |
How do I fix CVE-2025-65965?
Upgrade github.com/anchore/grype to 0.104.1 or later.
Is CVE-2025-65965 being exploited?
There is no known exploitation of CVE-2025-65965 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-65965, GHSA-6gxw-85q2-q646, GO-2025-4160, MINI-9mwm-3m23-xfh5.