Scanning Snaps for Vulnerabilities

[fthx]

Finally.

[popey]

@fthx

Is that the end of repetitive uploads or is this caused by a malware filter before publishing?

I have not seen/detected any of the malware we previously saw, since I published this blog post on 17th January.

https://blog.popey.com/2026/01/malware-purveyors-taking-over-published-snap-email-domains/

[fthx]

Hi Alan,

What’s causing snapd to not be detected as vulnerable?

https://snapscope.popey.com/package/snapd

Your scanner checks for vulnerable libraries included in the snaps or the CVE linked to the snap itself or both?

[fthx]

Ok I missed the point maybe. The deb snapd package is critical here, not the snap one?

[popey]

I just report what grype finds.

grype snapd --distro=ubuntu:22.04
 ✔ Pulled image  ✔ Downloaded snap                                                                                                            snapd@stable (amd64)  ✔ Indexed file system                                                                                 PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4_26382.snap
 ✔ Cataloged contents                                                             a4cfa267ed4a4ed379a3ecd7356f6a9a82383a3dfee0fd9d9969a32aea95e385
   ├── ✔ Packages                        [17 packages]
   ├── ✔ File metadata                   [1 locations]
   ├── ✔ Executables                     [311 executables]
   └── ✔ File digests                    [1 files]
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found

What could be misleading is that the site scans the current versions of snaps. It could benefit from re-running the grype scan on the old syft sboms for previous releases. I’ll look into it. Could be a lot of processing.

[t-a-k]

oHi,

Some package seems to fail scan ; it returns no vulnerabilities.

e.g. Chromium:

https://snapscope.popey.com/package/chromium

I use this snap inside mine and chromium vulnerabilities are well returned:

https://snapscope.popey.com/scan/684223

Same things with ffmpeg, … etc

https://snapscope.popey.com/package/ffmpeg-2404

Thanks for your work <3