Panic on scanning images with absent vex attestations.

[RomanenkoDenys]

Description

When i try to scan docker image with absent corresponding vex attestation image, trivy crashes.

Desired Behavior

Trivy should write warning message about absent vex attestations image (now loglevel is INFO) and skip using vex attestaion for scanning image.

Actual Behavior

trivy image registry.example/sys@sha256:5bad8fee3cab4e3fbcdcbb547b30a693931622f8d8fdd4b84bf4c16efbdf894e --vex=oci --show-suppressed --skip-vex-repo-update
2025-05-12T10:32:11+03:00	INFO	[vex] Skipping VEX repository update
2025-05-12T10:32:11+03:00	INFO	[vuln] Vulnerability scanning is enabled
2025-05-12T10:32:11+03:00	INFO	[secret] Secret scanning is enabled
2025-05-12T10:32:11+03:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-12T10:32:11+03:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret#recommendation for faster secret detection
2025-05-12T10:32:11+03:00	INFO	Number of language-specific files	num=2
2025-05-12T10:32:11+03:00	INFO	[gobinary] Detecting vulnerabilities...
2025-05-12T10:32:12+03:00	WARN	Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/dev/docs/scanner/vulnerability#severity-selection for details.
2025-05-12T10:32:12+03:00	INFO	[vex] No VEX attestations found	type="oci" purl="pkg:oci/deckhouse-oss@sha256%3A5bad8fee3cab4e3fbcdcbb547b30a693931622f8d8fdd4b84bf4c16efbdf894e?arch=amd64&repository_url=registry.example%2Fsys"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1052b1638]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/vex.(*OpenVEX).Matches(_, {{0x14001743480, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000e839d0, 0x10}, ...}, ...)
	/trivy-fork/pkg/vex/openvex.go:52 +0xe8
github.com/aquasecurity/trivy/pkg/vex.(*OpenVEX).NotAffected(_, {{0x14001743480, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000e839d0, 0x10}, ...}, ...)
	/trivy-fork/pkg/vex/openvex.go:27 +0x5c
github.com/aquasecurity/trivy/pkg/vex.(*Client).NotAffected(_, {{0x14001743480, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000e839d0, 0x10}, ...}, ...)
	/trivy-fork/pkg/vex/vex.go:130 +0xa0
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities.func2.1(0x0?, 0x2?)
	/trivy-fork/pkg/vex/vex.go:151 +0x54
github.com/aquasecurity/trivy/pkg/vex.reachRoot(0x14001621560, 0x1400185fe90, 0x1400185ff50, 0x14001a24480)
	/trivy-fork/pkg/vex/vex.go:170 +0x40
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities.func2({{0x14001743480, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000e839d0, 0x10}, {0x0, ...}, ...}, ...)
	/trivy-fork/pkg/vex/vex.go:158 +0xb8
github.com/samber/lo.Filter[...]({0x14000cbef08, 0x3, 0x1400185ff50}, 0x14001a248a0?)
	/go/pkg/mod/github.com/samber/lo@v1.47.0/slice.go:16 +0xd4
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities(0x140004d1dc0, 0x14001b08720, 0x14001a24ea8)
	/trivy-fork/pkg/vex/vex.go:142 +0x94
github.com/aquasecurity/trivy/pkg/vex.Filter({0x1072b30b0, 0x140005ba000}, 0x14001a25138, {{0x140009ef640, 0x1f}, {0x140005ea200, 0x1, 0x1}})
	/trivy-fork/pkg/vex/vex.go:84 +0x258
github.com/aquasecurity/trivy/pkg/result.Filter({_, _}, {0x2, {0xc20086df0044e8a0, 0x453974b7, 0x10990d0e0}, {0x16d7d35f3, 0x73}, {0x10580a80c, 0xf}, ...}, ...)
	/trivy-fork/pkg/result/filter.go:50 +0x224
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Filter(_, {_, _}, {{{0x1057d5ae2, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
	/trivy-fork/pkg/commands/artifact/run.go:269 +0x14c
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x1057d5ae2, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0x140009ef640, ...}, ...}, ...}, ...)
	/trivy-fork/pkg/commands/artifact/run.go:390 +0x920
github.com/aquasecurity/trivy/pkg/commands.NewImageCommand.func2(0x14000ea6908, {0x140017caa40?, 0x1?, 0x4?})
	/trivy-fork/pkg/commands/app.go:322 +0xf4
github.com/spf13/cobra.(*Command).execute(0x14000ea6908, {0x140017caa00, 0x4, 0x4})
	/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000ea6608)
	/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x10582a5ed?)
	/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041 +0x1c
main.run()
	/trivy-fork/cmd/trivy/main.go:39 +0x124
main.main()
	/trivy-fork/cmd/trivy/main.go:19 +0x20 

Reproduction Steps

1. Scan image from private registry.

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

trivy image registry.example@sha256:5bad8fee3cab4e3fbcdcbb547b30a693931622f8d8fdd4b84bf4c16efbdf894e --vex=oci --show-suppressed --skip-vex-repo-update --debug
2025-05-12T10:35:11+03:00       DEBUG   No plugins loaded
2025-05-12T10:35:11+03:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-05-12T10:35:11+03:00       DEBUG   Cache dir       dir="/Users/ash/Library/Caches/trivy"
2025-05-12T10:35:11+03:00       DEBUG   Cache dir       dir="/Users/ash/Library/Caches/trivy"
2025-05-12T10:35:11+03:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-05-12T10:35:11+03:00       DEBUG   Ignore statuses statuses=[]
2025-05-12T10:35:11+03:00       DEBUG   DB update was skipped because the local DB is the latest
2025-05-12T10:35:11+03:00       DEBUG   DB info schema=2 updated_at=2025-05-12T06:19:38.709774753Z next_update=2025-05-12T12:19:38.709774326Z downloaded_at=2025-05-12T06:57:45.167078Z
2025-05-12T10:35:11+03:00       INFO    [vex] Skipping VEX repository update
2025-05-12T10:35:11+03:00       DEBUG   [pkg] Package types     types=[os library]
2025-05-12T10:35:11+03:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2025-05-12T10:35:11+03:00       INFO    [vuln] Vulnerability scanning is enabled
2025-05-12T10:35:11+03:00       INFO    [secret] Secret scanning is enabled
2025-05-12T10:35:11+03:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-12T10:35:11+03:00       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret#recommendation for faster secret detection
2025-05-12T10:35:11+03:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-05-12T10:35:11+03:00       DEBUG   Initializing scan cache...      type="fs"
2025-05-12T10:35:12+03:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2025-05-12T10:35:12+03:00       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2025-05-12T10:35:12+03:00       DEBUG   [image] Detected image ID       image_id="sha256:3bca8d1f5dd99af1a787195939eccdeb2534c082a9420b408a6cf963d4bab6be"
2025-05-12T10:35:12+03:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:1fee6b08256fe6e48660cfe7de55954a34146d4f854873fc9d4d6223462787b0 sha256:43211f6f5d3ad099dd5314fc52a30d44ef017b1cf50aae9fd042468cf08ad91a sha256:edb126e831370b8ad0d7976daab1fbbc0797cd602324262e8c9671f5fd102352]
2025-05-12T10:35:12+03:00       DEBUG   [image] Detected base layers    diff_ids=[]
2025-05-12T10:35:12+03:00       DEBUG   OS is not detected.
2025-05-12T10:35:12+03:00       DEBUG   Detected OS: unknown
2025-05-12T10:35:12+03:00       INFO    Number of language-specific files       num=2
2025-05-12T10:35:12+03:00       INFO    [gobinary] Detecting vulnerabilities...
2025-05-12T10:35:12+03:00       DEBUG   [gobinary] Scanning packages for vulnerabilities        file_path="healthcheck"
2025-05-12T10:35:12+03:00       DEBUG   [gobinary] Skipping vulnerability scan as no version is detected for the package        name="webhook"
2025-05-12T10:35:12+03:00       DEBUG   [gobinary] Scanning packages for vulnerabilities        file_path="webhook"
2025-05-12T10:35:12+03:00       DEBUG   [gobinary] Skipping vulnerability scan as no version is detected for the package        name="webhook"
2025-05-12T10:35:12+03:00       WARN    Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/dev/docs/scanner/vulnerability#severity-selection for details.
2025-05-12T10:35:13+03:00       INFO    [vex] No VEX attestations found type="oci" purl="pkg:oci/deckhouse-oss@sha256%3A5bad8fee3cab4e3fbcdcbb547b30a693931622f8d8fdd4b84bf4c16efbdf894e?arch=amd64&repository_url=registry.example%2Fsys"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x102fd1638]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/vex.(*OpenVEX).Matches(_, {{0x14001789110, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000714f10, 0x10}, ...}, ...)
        /trivy-fork/pkg/vex/openvex.go:52 +0xe8
github.com/aquasecurity/trivy/pkg/vex.(*OpenVEX).NotAffected(_, {{0x14001789110, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000714f10, 0x10}, ...}, ...)
        /trivy-fork/pkg/vex/openvex.go:27 +0x5c
github.com/aquasecurity/trivy/pkg/vex.(*Client).NotAffected(_, {{0x14001789110, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000714f10, 0x10}, ...}, ...)
        /trivy-fork/pkg/vex/vex.go:130 +0xa0
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities.func2.1(0x0?, 0x2?)
        /trivy-fork/pkg/vex/vex.go:151 +0x54
github.com/aquasecurity/trivy/pkg/vex.reachRoot(0x14001bc4fc0, 0x14001bbc870, 0x14001bbc930, 0x14001c24480)
        /trivy-fork/pkg/vex/vex.go:170 +0x40
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities.func2({{0x14001789110, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x14000714f10, 0x10}, {0x0, ...}, ...}, ...)
        /trivy-fork/pkg/vex/vex.go:158 +0xb8
github.com/samber/lo.Filter[...]({0x14000e12a08, 0x3, 0x14001bbc930}, 0x14001c248a0?)
        /go/pkg/mod/github.com/samber/lo@v1.47.0/slice.go:16 +0xd4
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities(0x14001667a40, 0x14001494c00, 0x14001c24ea8)
        /trivy-fork/pkg/vex/vex.go:142 +0x94
github.com/aquasecurity/trivy/pkg/vex.Filter({0x104fd30b0, 0x14000966e70}, 0x14001c25138, {{0x140013567a0, 0x1f}, {0x140001cfaa0, 0x1, 0x1}})
        /trivy-fork/pkg/vex/vex.go:84 +0x258
github.com/aquasecurity/trivy/pkg/result.Filter({_, _}, {0x2, {0xc200870c114e82f0, 0x458b9fb4, 0x10762d0e0}, {0x16fab369b, 0x73}, {0x10352a80c, 0xf}, ...}, ...)
        /trivy-fork/pkg/result/filter.go:50 +0x224
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Filter(_, {_, _}, {{{0x1034f5ae2, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /trivy-fork/pkg/commands/artifact/run.go:269 +0x14c
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x1034f5ae2, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x140013567a0, ...}, ...}, ...}, ...)
        /trivy-fork/pkg/commands/artifact/run.go:390 +0x920
github.com/aquasecurity/trivy/pkg/commands.NewImageCommand.func2(0x14000a8ec08, {0x1400132d770?, 0x1?, 0x5?})
        /trivy-fork/pkg/commands/app.go:322 +0xf4
github.com/spf13/cobra.(*Command).execute(0x14000a8ec08, {0x1400132d720, 0x5, 0x5})
        /go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000a8e908)
        /go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x10354a5ed?)
        /go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041 +0x1c
main.run()
        /trivy-fork/cmd/trivy/main.go:39 +0x124
main.main()
        /trivy-fork/cmd/trivy/main.go:19 +0x20

Operating System

Mac OS Sequioia

Version

./trivy --version                                                                                                                                                                         
Version: dev
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-05-12 06:19:38.709774753 +0000 UTC
  NextUpdate: 2025-05-12 12:19:38.709774326 +0000 UTC
  DownloadedAt: 2025-05-12 06:57:45.167078 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @RomanenkoDenys
Thanks for your report!

Can you create test image for this issue and push into dockerhub?

Regards, Dmitiry

[RomanenkoDenys]

Hello @DmitriyLewen

trivy image  romanenkodenys/trivy-test:novex --vex=oci --show-suppressed --skip-vex-repo-update --debug
2025-05-12T13:09:56+03:00	DEBUG	No plugins loaded
2025-05-12T13:09:56+03:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-05-12T13:09:56+03:00	DEBUG	Cache dir	dir="/Users/ash/Library/Caches/trivy"
2025-05-12T13:09:56+03:00	DEBUG	Cache dir	dir="/Users/ash/Library/Caches/trivy"
2025-05-12T13:09:56+03:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-05-12T13:09:56+03:00	DEBUG	Ignore statuses	statuses=[]
2025-05-12T13:09:56+03:00	DEBUG	DB update was skipped because the local DB is the latest
2025-05-12T13:09:56+03:00	DEBUG	DB info	schema=2 updated_at=2025-05-12T06:19:38.709774753Z next_update=2025-05-12T12:19:38.709774326Z downloaded_at=2025-05-12T06:57:45.167078Z
2025-05-12T13:09:56+03:00	INFO	[vex] Skipping VEX repository update
2025-05-12T13:09:56+03:00	DEBUG	[pkg] Package types	types=[os library]
2025-05-12T13:09:56+03:00	DEBUG	[pkg] Package relationships	relationships=[unknown root direct indirect]
2025-05-12T13:09:56+03:00	INFO	[vuln] Vulnerability scanning is enabled
2025-05-12T13:09:56+03:00	INFO	[secret] Secret scanning is enabled
2025-05-12T13:09:56+03:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-05-12T13:09:56+03:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret#recommendation for faster secret detection
2025-05-12T13:09:56+03:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-05-12T13:09:56+03:00	DEBUG	Initializing scan cache...	type="fs"
2025-05-12T13:09:57+03:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-05-12T13:09:57+03:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2025-05-12T13:09:58+03:00	DEBUG	[image] Detected image ID	image_id="sha256:f5334a29255b3b20c84d12b0be363834bca61ffdb1b2b422f45b74a98ff6696d"
2025-05-12T13:09:58+03:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:1fee6b08256fe6e48660cfe7de55954a34146d4f854873fc9d4d6223462787b0 sha256:43211f6f5d3ad099dd5314fc52a30d44ef017b1cf50aae9fd042468cf08ad91a sha256:1aaa94d62d46834f1a9cea7580b0e587e8d355cf5a14224dcb9c69d38312c1ee]
2025-05-12T13:09:58+03:00	DEBUG	[image] Detected base layers	diff_ids=[]
2025-05-12T13:09:58+03:00	DEBUG	OS is not detected.
2025-05-12T13:09:58+03:00	DEBUG	Detected OS: unknown
2025-05-12T13:09:58+03:00	INFO	Number of language-specific files	num=1
2025-05-12T13:09:58+03:00	INFO	[gobinary] Detecting vulnerabilities...
2025-05-12T13:09:58+03:00	DEBUG	[gobinary] Scanning packages for vulnerabilities	file_path="descheduler"
2025-05-12T13:09:58+03:00	DEBUG	[gobinary] Skipping vulnerability scan as no version is detected for the package	name="sigs.k8s.io/descheduler"
2025-05-12T13:09:58+03:00	WARN	Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/dev/docs/scanner/vulnerability#severity-selection for details.
2025-05-12T13:10:00+03:00	INFO	[vex] No VEX attestations found	type="oci" purl="pkg:oci/trivy-test@sha256%3A342d8c179b65692761607e1e23356739f2d3ccb11c6edce049025d3e88f0cf44?arch=amd64&repository_url=index.docker.io%2Fromanenkodenys%2Ftrivy-test"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x106e1d638]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/vex.(*OpenVEX).Matches(_, {{0x140018a4320, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x140001ce798, 0x13}, ...}, ...)
	/trivy-fork/pkg/vex/openvex.go:52 +0xe8
github.com/aquasecurity/trivy/pkg/vex.(*OpenVEX).NotAffected(_, {{0x140018a4320, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x140001ce798, 0x13}, ...}, ...)
	/trivy-fork/pkg/vex/openvex.go:27 +0x5c
github.com/aquasecurity/trivy/pkg/vex.(*Client).NotAffected(_, {{0x140018a4320, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x140001ce798, 0x13}, ...}, ...)
	/trivy-fork/pkg/vex/vex.go:130 +0xa0
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities.func2.1(0x0?, 0x3?)
	/trivy-fork/pkg/vex/vex.go:151 +0x54
github.com/aquasecurity/trivy/pkg/vex.reachRoot(0x14001c22480, 0x14001991aa0, 0x14001991b60, 0x14001d1c480)
	/trivy-fork/pkg/vex/vex.go:170 +0x40
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities.func2({{0x140018a4320, 0xe}, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0x140001ce798, 0x13}, {0x0, ...}, ...}, ...)
	/trivy-fork/pkg/vex/vex.go:158 +0xb8
github.com/samber/lo.Filter[...]({0x14001112308, 0x4, 0x14001991b60}, 0x14001d1c8a0?)
	/go/pkg/mod/github.com/samber/lo@v1.47.0/slice.go:16 +0xd4
github.com/aquasecurity/trivy/pkg/vex.filterVulnerabilities(0x140018e5ce0, 0x14001c02180, 0x14001d1cea8)
	/trivy-fork/pkg/vex/vex.go:142 +0x94
github.com/aquasecurity/trivy/pkg/vex.Filter({0x108e1f0b0, 0x14000a1ac40}, 0x14001d1d138, {{0x14000b632c0, 0x1f}, {0x140000484a0, 0x1, 0x1}})
	/trivy-fork/pkg/vex/vex.go:84 +0x258
github.com/aquasecurity/trivy/pkg/result.Filter({_, _}, {0x2, {0xc200901da210c788, 0xa08dd16f, 0x10b4790e0}, {0x16bc6764b, 0x1f}, {0x10737680c, 0xf}, ...}, ...)
	/trivy-fork/pkg/result/filter.go:50 +0x224
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).Filter(_, {_, _}, {{{0x107341ae2, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
	/trivy-fork/pkg/commands/artifact/run.go:269 +0x14c
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x107341ae2, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0x14000b632c0, ...}, ...}, ...}, ...)
	/trivy-fork/pkg/commands/artifact/run.go:390 +0x920
github.com/aquasecurity/trivy/pkg/commands.NewImageCommand.func2(0x14000cd0c08, {0x14001688870?, 0x1?, 0x5?})
	/trivy-fork/pkg/commands/app.go:322 +0xf4
github.com/spf13/cobra.(*Command).execute(0x14000cd0c08, {0x14001688820, 0x5, 0x5})
	/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985 +0x834
github.com/spf13/cobra.(*Command).ExecuteC(0x14000cd0908)
	/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x1073965ed?)
	/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041 +0x1c
main.run()

[RomanenkoDenys]

image - romanenkodenys/trivy-test:novex

[DmitriyLewen]

Hello @RomanenkoDenys
Thanks for report!

Created #8857 for this issue.

Regards, Dmitriy