Grype
Vulnerability scanner for container images and filesystems that identifies CVEs in packages, dependencies, and operating system distributions.
Technical Architecture & Overview
Grype is a vulnerability scanner for container images and filesystems. It compares installed packages and dependencies against vulnerability databases and includes EPSS and CISA KEV data. The CLI runs locally and matches against a vulnerability database that it downloads and caches.
Targeted Technical Use Cases
Use Grype to scan container images, SBOMs, and project directories for known CVEs in CI/CD pipelines.
Evaluation & Trade-offs
Core Strengths
- +Runs locally with no need for a remote vulnerability platform.
- +Covers operating system packages and many language-specific ecosystems.
- +Includes EPSS and KEV data for prioritizing which vulnerabilities to fix first.
Trade-Offs & Limitations
- -May report false positives for packages matched through CPE data from the NVD.
- -Detection depends on the locally cached vulnerability database, which updates on launch when a newer version is available.
Defensive Security Application
Use Grype to block container images with critical or high-risk CVEs from deployment and drive patching priorities.
Frequently Asked Questions
What is Grype?→
Grype is a vulnerability scanner for container images and filesystems. It compares installed packages and dependencies against vulnerability databases and includes EPSS and CISA KEV data. The CLI runs locally and matches against a vulnerability database that it downloads and caches.
What is Grype used for?→
Use Grype to scan container images, SBOMs, and project directories for known CVEs in CI/CD pipelines.
What are the strengths of Grype?→
- +Runs locally with no need for a remote vulnerability platform.
- +Covers operating system packages and many language-specific ecosystems.
- +Includes EPSS and KEV data for prioritizing which vulnerabilities to fix first.
What are the limitations of Grype?→
- +May report false positives for packages matched through CPE data from the NVD.
- +Detection depends on the locally cached vulnerability database, which updates on launch when a newer version is available.
How is Grype used defensively?→
Use Grype to block container images with critical or high-risk CVEs from deployment and drive patching priorities.