Trivy scanner does not detect (several) language / runtime vulnerabilities in container images #9759
Replies: 3 comments 1 reply
-
|
Hello @wojciechka Your examples are quite large, and it’s not entirely clear what exactly you expect. Keep in mind that some files are only scanned in certain modes (for example, only in fs/repo or, conversely, only in image/rootfs). If you can provide more details — what kind of packages you expect, how you installed them, and which vulnerabilities you expect to see — I’ll be able to help you faster and more accurately. Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
@DmitriyLewen Thank you for the information. I mentioned all images that I was working on. I apologize if that caused confusion or is a lot. I checked the supported OSes and languages - all images are Wolfi/Chainguard based. The ones I listed use Python, Node.js and Golang, so it should be a supported combination. Perhaps it's better to focus on just one image - perhaps This is an image built using Chainguard OS, that mostly includes a Golang binary ( That Go binary is built with Golang v1.24.5 that is vulnerable to When I try to scan it as an image with When I use I am wondering if this is because the binary is part of an APK, and then those binaries are not scanned? Or are there flags in trivy that I need to pass to enable scanning of Golang binaries in an image, if those binaries were part of an APK file? Please let me know if this helped. I am happy to provide more context, or try to test more things on my end, as it may be that I am misunderstanding some parts of trivy. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @wojciechka
|
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for this. It was exactly what I was looking for. All Golang, Python and Node vulnerabilities are now present and it is what I was expecting to get. Thank you again for all the help. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
IDs
GHSA-wqvq-5m8c-6g24 GHSA-xvch-5gv4-984h CVE-2025-47907 GHSA-4v7x-pqxf-cx7m CVE-2024-24790 CVE-2023-45285
Description
While looking into detection of vulnerabilities for Wolfi / Chainguard based images, we've created a set of sample images and run them against vulnerability scanners.
We've noticed some languages / runtimes (Golang, Python, NodeJS/npm) are not detected by Trivy and would like to better understand if there is anything that could be done to improve detection, either in Trivy or in metadata for Wolfi / Chainguard. We'd also like to know whether this is a false detection or if this is not supported.
Images that include Python and NodeJS/Npm modules that are vulnerable:
For Python ones, the vulnerability is
GHSA-wqvq-5m8c-6g24and it is an older version of urllib3 package shipped in the image.For NodeJS, the package is minimist and is vulnerable to
GHSA-xvch-5gv4-984h.Test images including Golang binaries that have vulnerabilities due to Golang version and Go modules used:
The first 2 images contain vulnerabilities due to older version of Golang (
CVE-2025-47907) and an older version ofgolang.org/x/netGo module (GHSA-4v7x-pqxf-cx7m).The next 4 images include vulnerability for Golang (
CVE-2024-24790) and an APK (CVE-2023-45285) - reported againstaws-ebs-csi-driver-1.19APK package version 1.19.0-r9.Reproduction Steps
Beta Was this translation helpful? Give feedback.
All reactions