Docker Scout cves with vex-location

[jamesbr-ashn]

I have been attempting to bypass some vulnerabilities on the Microsoft SDK from mcr.microsoft.com/dotnet/sdk@8.0. I have created three documents, each with a statement targeting a separate vulnerability (CVE-2025-26646, CVE-2025-55247, CVE-2025-59375). Below is an example of one of those vex files.

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://openvex.dev/docs/public/vex-3171d2fb0f688f96c42705c2716806445f662ae0683237a1064be86fa8379d97",
  "author": "me@my.com",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2025-59375"
      },
      "products": [
        {
          "@id": "pkg:docker/mcr.microsoft.com/dotnet/sdk@8.0"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path"
    }
  ],
  "timestamp": "2025-10-29T16:40:29Z"
}

I am running docker scout cves mcr.microsoft.com/dotnet/sdk:8.0 --vex-location "C:\repos\myrepo\dotnetsdk\8.0\vex\" --only-vex-affected . The results of the analyzed image still show the vulnerabilities and still report the 3 vulnerabilities I am trying to address across 5 files. I have attempted this with and without subcomponents.

   0C     1H     0M     2L  expat 2.5.0-1+deb12u2
pkg:deb/debian/expat@2.5.0-1%2Bdeb12u2?os_distro=bookworm&os_name=debian&os_version=12

    x HIGH CVE-2025-59375
      https://scout.docker.com/v/CVE-2025-59375
      Affected range : >=2.5.0-1+deb12u2
      Fixed version  : not fixed

    x LOW CVE-2024-28757
      https://scout.docker.com/v/CVE-2024-28757
      Affected range : >=2.5.0-1+deb12u2
      Fixed version  : not fixed

    x LOW CVE-2023-52426
      https://scout.docker.com/v/CVE-2023-52426
      Affected range : >=2.5.0-1+deb12u2
      Fixed version  : not fixed


   0C     1H     0M     0L  Microsoft.Build.Tasks.Core 17.3.4
pkg:nuget/Microsoft.Build.Tasks.Core@17.3.4

    x HIGH CVE-2025-26646 [External Control of File Name or Path]
      https://scout.docker.com/v/CVE-2025-26646
      Affected range : >=17.0.0
                     : <=17.8.3
      Fixed version  : 17.8.29
      CVSS Score     : 8.0
      CVSS Vector    : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H


   0C     1H     0M     0L  Microsoft.Build.Tasks.Core 17.11.31
pkg:nuget/Microsoft.Build.Tasks.Core@17.11.31

    x HIGH CVE-2025-55247 [Improper Link Resolution Before File Access ('Link Following')]
      https://scout.docker.com/v/CVE-2025-55247
      Affected range : >=17.11.0
                     : <=17.11.31
      Fixed version  : 17.11.48
      CVSS Score     : 7.3
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H


   0C     1H     0M     0L  Microsoft.Build.Utilities.Core 17.11.31
pkg:nuget/Microsoft.Build.Utilities.Core@17.11.31

    x HIGH CVE-2025-55247 [Improper Link Resolution Before File Access ('Link Following')]
      https://scout.docker.com/v/CVE-2025-55247
      Affected range : >=17.11.0
                     : <=17.11.31
      Fixed version  : 17.11.48
      CVSS Score     : 7.3
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H


   0C     1H     0M     0L  Microsoft.Build 17.11.31
pkg:nuget/Microsoft.Build@17.11.31

    x HIGH CVE-2025-55247 [Improper Link Resolution Before File Access ('Link Following')]
      https://scout.docker.com/v/CVE-2025-55247
      Affected range : >=17.11.0
                     : <=17.11.31
      Fixed version  : 17.11.48
      CVSS Score     : 7.3
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

I know I must be missing something simple, but my troubleshooting has not unearthed the cause. I'm hoping someone from the community can help me.

[TylerHaigh]

+1 to this.
We saw this in a previous version of docker scout and raised this issue previously
#115

We have updated to latest version

version: v1.18.4 (go1.24.6 - linux/amd64)
git commit: fc5a36b0a880177e9222ead7199a4fbc43cf7184

---

Vex Suppression File

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://openvex.dev/docs/public/vex-9d8d04259ab55dd9f8415a5ad4a4d9696b5e93a9bca6b455bec487f4c075cec2",
  "author": "tyler.haigh@github.com",
  "timestamp": "2025-11-18T15:32:15.0224966+11:00",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2025-64756"
      },
      "timestamp": "2025-11-18T15:32:15.0224966+11:00",
      "products": [
        {
          "@id": "pkg:npm/glob@11.0.3"
        },
        {
          "@id": "pkg:npm/glob@10.4.5"
        },
        {
          "@id": "pkg:npm/glob<11.1"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present"
    }
  ]
}

$ docker scout cves my-container-image       --vex-location ./vex --only-vex-affected --only-severity critical,high
    ✓ Image stored for indexing
    ✓ Indexed 504 packages
    ✓ Loaded 1 VEX document
    ✗ Detected 2 vulnerable packages with a total of 1 vulnerability


## Overview

                    │             Analyzed Image
────────────────────┼──────────────────────────────────────────
  Target            │  my-container-image:latest 
    digest          │  4244fd99b9e3 
    platform        │ linux/amd64
    vulnerabilities │    0C     2H     0M     0L 
    size            │ 108 MB
    packages        │ 504


## Packages and Vulnerabilities

   0C     1H     0M     0L  glob 10.4.5
pkg:npm/glob@10.4.5

    ✗ HIGH CVE-2025-64756 [Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')]
      https://scout.docker.com/v/CVE-2025-64756
      Affected range : >=10.3.7
                     : <=11.0.3
      Fixed version  : 11.1.0
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
      VEX            : not affected [vulnerable code not present]
                     : tyler.haigh@github.com


   0C     1H     0M     0L  glob 11.0.3
pkg:npm/glob@11.0.3

    ✗ HIGH CVE-2025-64756 [Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')]
      https://scout.docker.com/v/CVE-2025-64756
      Affected range : >=10.3.7
                     : <=11.0.3
      Fixed version  : 11.1.0
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
      VEX            : not affected [vulnerable code not present]
                     : tyler.haigh@github.com



2 vulnerabilities found in 2 packages
  CRITICAL  0
  HIGH      2
  MEDIUM    0
  LOW       0