Affected by GO-2025-3767 and 1 other vulnerabilities

GO-2025-3767: OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal in github.com/google/osv-scalibr

GO-2025-4149: OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr

binary

package

v0.2.0 Latest Latest Go to latest Published: Apr 23, 2025 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Package binary implements a detector that uses govulncheck to scan for vulns on Go binaries found on the filesystem.

View Source

const (
	// Name is the unique name of this detector.
	Name = "govulncheck/binary"
)

This section is empty.

func New() detector.Detector

New returns a detector.

type Detector struct {
	OfflineVulnDBPath string
}

Detector is a SCALIBR Detector that uses govulncheck to scan for vulns on Go binaries found on the filesystem.

func (Detector) Name() string

Name of the detector.

func (Detector) RequiredExtractors() []string

RequiredExtractors returns the go binary extractor.

func (d Detector) Requirements() *plugin.Capabilities

Requirements of the detector.

func (d Detector) Scan(ctx context.Context, scanRoot *scalibrfs.ScanRoot, px *packageindex.PackageIndex) ([]*detector.Finding, error)

Scan takes the go binaries gathered in the extraction phase and runs govulncheck on them.

func (Detector) Version() int

Version of the detector.