The Unreasonable Effectiveness of Vex in NixOS
Blog post argues NixOS can automate VEX statements so teams skip unreachable CVE findings.
The post argues SBOM scanners such as Syft and Grype flag vulnerabilities that reachability analysis would dismiss. A sample Go app using golang.org/x/text v0.38.0 matched GO-2026-5970 and GO-2026-6629, but govulncheck found the vulnerable symbols unused. A Debian Trixie OpenSSH container produced 284 matches, including unfixed CVE-2007-2768, which needs OPIE through PAM keyboard-interactive authentication that the image does not enable. The author contrasts that manual triage with NixOS, whose build model could support automated VEX statements; the excerpt ends before the method is fully described.
38