Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
anchore/grype
main @ 80c4dcb
5
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
.github/actions/bootstrap/action.yaml: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Grype was historically leaking active registry authentication credentials directly into generated JSON/report documents during CLI output serialization, leading to CVE-2025-65965. Developers must ensure any CLI models or document exporters strip credentials before writing to output streams.
Code Injection: Using direct shell inline expansion of untrusted inputs within GitHub Actions allowed command injection via apt installation parameters. Developers must always pass action inputs through intermediate environment variables rather than direct string interpolation inside 'run' steps.
Auth Bypass: Registry credentials could be evaluated as valid even if the username was empty, bypassing intended access controls. Complete credential validation must require both username and password components to be non-empty before initiating external registry connection sequences.