VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/anchore/syft: vulnerability history, versions and safety

github.com/anchore/syft is a package in the Go ecosystem. Vulert records 4 vulnerabilities for it across 120 releases, from Feb 2023 to Mar 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
4 vulnerabilities recorded M2 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
2 in the last 12 months

Most recent disclosure 23 Mar 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/anchore/syft vulnerabilities

Vulert verdict on github.com/anchore/syft v1.55.0 i

Updated on 23 Oct 2026

Action needed: v1.55.0 has 2 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 87/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.55.0 — affected i
  • Vulnerabilities on record 4 over 3 years · 2 in the last year i
  • Latest disclosure 23 Mar 2026 i
  • Highest CVSS 6.5 i
  • With no published fix 0 i
  • Stars 9,709 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/anchore/syft, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.55.1-0.20261021211043-b55707f60fdd 21 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.55.0 19 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261019165940-203c490c1467 19 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20261016132800-a81193226ffd 16 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261016132800-a81193226ffd 16 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20261015112055-30200f1d691d 15 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261015112055-30200f1d691d 15 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20261012202927-ddc490c5c560 12 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261012202927-ddc490c5c560 12 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261012195720-f8ffa7382e39 12 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261012190002-c2ea35ef3287 12 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261012015657-c0109a7ad19c 12 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20261009134252-33419c8f397e 09 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261009134252-33419c8f397e 09 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261009133722-679027251852 09 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261009133551-3e41abadc431 09 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20261007204113-546c872c9d94 07 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261007204113-546c872c9d94 07 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.2-0.20261007102720-d9489c2230b1 07 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.1 06 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.1-0.20261005150237-29b92a58c188 05 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.1-0.20261005015249-6d2493bae42f 05 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.1-0.20261002133002-bc68299565d1 02 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.1-0.20261001212109-c33fa32cf100 01 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.53.1-0.20261001190050-cc326e45a621 01 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.54.0 01 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.53.1-0.20261001153521-29d2de72c860 01 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.53.0 01 Oct 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260930194546-f76ae8e57c2a 30 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260929214447-b23e4617312a 29 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260929202642-d0e1e7be05f3 29 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260929182504-c0072873c95e 29 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260929182504-c0072873c95e 29 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260929151917-236ab25393c9 29 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260928192245-f7f3c6efc3f3 28 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260928015042-fb55856e337f 28 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260925195330-643bf2c24d5a 25 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260924144052-14e96fcbf81e 24 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260923172028-409ac78f62a4 23 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260918133041-b49f0172f636 18 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260918133041-b49f0172f636 18 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260918003932-3b41acb0ff5f 18 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260917181116-3325493831ed 17 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.1-0.20260917181116-3325493831ed 17 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260917140946-02ba369d13b4 17 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.52.0 17 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260916014054-74073aa48177 16 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260914221756-b4ee6e4696b6 14 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260914133019-356e601cd509 14 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260911214607-ee05a595b664 11 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260911212510-d85c72a08e5d 11 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260911192720-c4800b239392 11 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260911184445-de98400c39da 11 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260911143414-3ec2e33d73fe 11 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260910132119-1d25dfe4da0c 10 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260910022944-0c049806bdb1 10 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260909145358-9addda3da574 09 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260908152239-767c83d5131e 08 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260904133025-392539dc28bd 04 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260903200920-c935b71c9e28 03 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260902082704-77031752faf6 02 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260831172105-12d5544b2a51 31 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260829102402-af937d74c00c 29 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.2-0.20260828133327-401797967055 28 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1 27 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260827042009-d3734ddeb2d6 27 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260821213647-bf82010f3c38 21 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260820201741-39c9c690df90 20 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260819181515-5c6cf08a8c82 19 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260819141110-ab508169e6d3 19 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260818154400-360dbc04aa20 18 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260814200858-58a033f92409 14 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.1-0.20260814200858-58a033f92409 14 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260810142629-2293641e3bd6 10 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.51.0 10 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260807143814-949ac7036949 07 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260807143814-949ac7036949 07 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260805140017-68da404bd7c8 05 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260804144635-35bf33bcf055 04 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260803172036-7f73d6a6038a 03 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260731135021-ef40eec38d03 31 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260731135021-ef40eec38d03 31 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260730105936-dd639c09b285 30 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260730105936-dd639c09b285 30 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260729185020-31a352d03050 29 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.1-0.20260729175043-08e913a2cec3 29 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.49.1-0.20260727192049-16223e6dd789 27 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.50.0 27 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.49.1-0.20260727145013-86baeeb481ce 27 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.49.1-0.20260724134824-9af0098a6847 24 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.49.1-0.20260723190336-c890e7f17f8d 23 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260720180457-29fd7d0dec81 20 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.48.1-0.20260720180457-29fd7d0dec81 20 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.49.0 20 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260717135225-ae9534203d4a 17 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.48.1-0.20260717135225-ae9534203d4a 17 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20260716142122-3e2bc6ed095f 16 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.48.0 16 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.46.1-0.20260716020958-5e11775c8b76 16 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.47.0 16 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.46.1-0.20260714124953-2805655ab046 14 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713204334-552ddbfadb48 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713204016-f6b5d3e736b8 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713193351-4312699dd6f3 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713192531-987ae7f26a3b 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713173704-2a319babba86 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713170820-80c3189b0e30 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713151501-da77ea388a01 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713143023-1dcac54b0e10 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260713140126-0734b95ce403 13 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260710133142-c4a0b6f6470e 10 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260708165513-e8abab2e775f 08 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260707141115-002a326c41e9 07 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260706151837-3e399256b3dc 06 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260703134248-6f5c83a55853 03 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260702183437-ba661e83a7e5 02 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260701131133-656a4d46d741 01 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260701033749-a1831ce3b499 01 Jul 2026 M1 U1 — Yes Details →
v1.46.1-0.20260630143257-148fe572bcd6 30 Jun 2026 M1 U1 — Yes Details →
v1.46.1-0.20260629192347-deee79411a1e 29 Jun 2026 M1 U1 — Yes Details →

The newest 120 of 1,255 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 1
  • 2024 1
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 4 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/anchore/syft

The 4 most severe of 4 vulnerabilities recorded for this package

Search all 4 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-24827: Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set 6.5 medium 0.70.0 08 Feb 2023
CVE-2026-33481: Syft Improper Temporary File Cleanup Vulnerability 5.3 medium 1.42.3 20 Mar 2026
CVE-2023-24827: Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set N/A unrated 0.70.0 20 Aug 2024
CVE-2026-33481: Improper Temporary File Cleanup in github.com/anchore/syft N/A unrated 1.42.3 23 Mar 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/anchore/syft

Is github.com/anchore/syft safe to use?

Vulert records 4 vulnerabilities for github.com/anchore/syft in Go: 0 critical, 0 high, 2 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/anchore/syft's Vulert package health score?

Vulert scores github.com/anchore/syft 87/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/anchore/syft affected?

Yes. v1.55.0, the version you would install today, has 2 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/anchore/syft have?

4 vulnerabilities are recorded for github.com/anchore/syft in the Go ecosystem: 0 critical, 0 high, 2 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/anchore/syft vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/anchore/syft in the last 12 months, and the oldest entry in this database dates to 08 Feb 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/anchore/syft are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/anchore/syft for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/anchore/syft version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.