Trivy offline vulnerability scanning

Trivy Offline Vulnerability Scanning

Overview

Trivy is a comprehensive security scanner that can detect vulnerabilities in OS packages and application dependencies. In offline mode, it uses a pre-downloaded vulnerability database.

Key Commands

Scan a package-lock.json file (offline, JSON output)

trivy fs --skip-db-update --skip-java-db-update \
  --format json \
  --scanners vuln \
  --pkg-types library \
  --severity HIGH,CRITICAL \
  /path/to/package-lock.json

Important Flags

• --skip-db-update: Use the already-downloaded DB (offline mode)
• --skip-java-db-update: Skip Java DB update for non-Java projects
• --format json: Machine-readable output for downstream processing
• --severity HIGH,CRITICAL: Filter by severity level
• --scanners vuln: Only scan for vulnerabilities (skip misconfig, secret, etc.)
• --pkg-types library: Scan application libraries only

Output Structure (JSON)

The JSON output contains a Results array. Each result has:

• Target: the scanned file
• Vulnerabilities: array of vulnerability objects with fields:
  • PkgName: package name
  • InstalledVersion: installed version
  • VulnerabilityID: CVE ID (e.g., CVE-2023-1234)
  • Severity: HIGH, CRITICAL, etc.
  • CVSS: object with scoring from multiple sources (nvd, ghsa, redhat)
  • FixedVersion: version that fixes the vulnerability (may be empty)
  • Title: short vulnerability title
  • PrimaryURL: reference URL
  • Description: longer description (use if Title is empty)