grype

What it does

Grype (Anchore) matches packages against vulnerability data (NVD, GitHub advisories, distro feeds) and shows CVEs with severity and the fixed version. It scans images directly or reads an SBOM from Syft, so you can re-scan old releases quickly when new CVEs come out. --fail-on makes it a CI gate.

How to write it

grype SOURCE [--fail-on SEVERITY] [-o FORMAT]

Main parts

Sources

IMAGE: Container image.
dir:PATH: A folder.
sbom:FILE: An SBOM (Syft, CycloneDX, SPDX).
db status|update: The vulnerability database.

Options 6

Most used

Flags

--fail-on low|medium|high|critical: Exit 1 at this severity or higher.
--only-fixed: Show only CVEs that have a fix.
-o table|json|sarif|cyclonedx|template: Output format.
--file FILE: Write output to a file.
-c FILE: Config file (ignore rules).
--add-cpes-if-none: Better matching for unknown packages.

Examples 10

$ run as a normal user# run as root (or with sudo)

1Scan an image

$grype nginx:1.27
$grype ghcr.io/s0sta/shop:1.4.0 --only-fixed

2CI gate on high and critical

$grype ghcr.io/s0sta/shop:1.4.0 --fail-on high --only-fixed

3Scan an SBOM

$syft ghcr.io/s0sta/shop:1.4.0 -o syft-json=shop.syft.json
$grype sbom:shop.syft.json

4Scan a project folder
```
$grype dir:.
```

5SARIF for GitHub code scanning

$grype dir:. -o sarif --file grype.sarif

6Ignore an accepted finding

$cat .grype.yaml
ignore:
  - vulnerability: CVE-2024-12345
    reason: "not reachable; review 2027-01-31"

7Update and check the database
```
$grype db update
$grype db status
```

8Only critical CVEs as JSON

$grype nginx:1.27 -o json | jq -r '.matches[] | select(.vulnerability.severity=="Critical") | .vulnerability.id' | sort -u

9Use the GitHub Action

$cat .github/workflows/grype.yml
      - uses: anchore/scan-action@v4
        with: { image: "ghcr.io/s0sta/shop:1.4.0", fail-build: true, severity-cutoff: high }

10Compare with Trivy

$trivy image -q --severity CRITICAL ghcr.io/s0sta/shop:1.4.0 | tail -3

Watch out

Different scanners use different data; small differences between Grype and Trivy are normal.

Files

~/.cache/grype/db/: Vulnerability database.
.grype.yaml: Project config and ignores.

Tips to remember

Re-scan the SBOMs of all running releases every night.

Exit codes

`0`	Success, nothing at or above --fail-on.
`1`	Findings at or above --fail-on, or an error.

`grype`

What it does

How to write it

Main parts

Sources

Options 6

Flags

Examples 10

1Scan an image

2CI gate on high and critical

3Scan an SBOM

4Scan a project folder

5SARIF for GitHub code scanning

6Ignore an accepted finding

7Update and check the database

8Only critical CVEs as JSON

9Use the GitHub Action

10Compare with Trivy

Watch out

Files

Tips to remember

Exit codes

Full manual

What it does

How to write it

Main parts

Sources

Options 6

Flags

Examples 10

1Scan an image

2CI gate on high and critical

3Scan an SBOM

4Scan a project folder

5SARIF for GitHub code scanning

6Ignore an accepted finding

7Update and check the database

8Only critical CVEs as JSON

9Use the GitHub Action

10Compare with Trivy

Watch out

Files

Tips to remember

Exit codes

Related commands

Used in these lessons

Full manual

`grype`