ChimangoScan Exposes Docker Hub's Widespread Vulnerabilities

A recent study published on arXiv presents ChimangoScan, a pipeline that explored the entire Docker Hub namespace, which includes 12,716,568 repositories and a staggering 663.8 billion total pulls. By reconstructing the image layer graph featuring 54.4 million IS_BASE_OF edges, the tool assigns an exposure score to images, factoring in both their individual pull counts and those of their downstream dependencies. Analyzing the top 52,895 repositories with the highest exposure, representing 84.7% of all recorded pulls, involved six independent scanners, resulting in 170.4 million findings. The findings indicate that vulnerabilities are widespread: 96.3% of images contain a known package vulnerability, while 93.4% have a critical one. This research emphasizes the reliance on specific tools for ecosystem-scale assessments, which previously depended on a single detector and limited sample sizes in comparative studies, highlighting systemic risks in container deployments where flaws in commonly reused base images affect all derived images.