Agent Wranglers

APS-106Recommended

Say which known holes do not affect you with VEX

A scanner may report a vulnerable package that cannot be exploited in your product. Record a VEX statement for it, with the status not affected and a justification. Suppress findings only through these statements.

By Agent Wranglers. Updated .

How to do it

VEX stands for Vulnerability Exploitability eXchange. A statement names the product, the vulnerability and one status, such as not affected, affected, fixed or under investigation. A not affected status needs a reason, such as the vulnerable code is not present or never runs. Write statements in a standard format, such as OpenVEX, CycloneDX or CSAF. Give your scanner the VEX file, so the next run stays quiet for those findings and still fails on new ones. Publish the statements with the bill of materials for software that customers run, so they skip the same triage. Fix deadlines for the rest are in Fix each finding within the time its severity allows.

Examples

JSON example

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://example.com/vex/2026-10-27",
  "author": "Example Shop security team",
  "timestamp": "2026-10-27T09:00:00Z",
  "statements": [{
    "vulnerability": { "name": "CVE-2026-12345" },
    "products": [{ "@id": "pkg:oci/shop@sha256:4f1c..." }],
    "status": "not_affected",
    "justification": "vulnerable_code_not_in_execute_path"
  }]
}

Shell example

trivy image --vex vex.json --exit-code 1 registry.example.com/shop:2026.10.27

How to check

CI runs the scanner with the VEX file. It fails on any finding not covered by a statement, and on any statement with the status not affected but no justification. The scanner's own ignore list is empty.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/supply-chain/vex">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.