Trivy offline vulnerability scanning

Trivy Offline Vulnerability Scanning

Setup

Trivy requires a pre-downloaded vulnerability database for offline scanning.

Check database exists:

ls /root/trivy-cache/db/
# Should show: trivy.db  metadata.json

Key Flags

Flag	Purpose
fs <target>	Scan a file or directory
--format json	JSON output for parsing
--output <file>	Save results to file
--scanners vuln	Only vulnerability scanning
--skip-db-update	Do not update database (offline)
--offline-scan	Enable offline mode
--cache-dir <path>	Path to offline database
--severity HIGH,CRITICAL	Filter by severity

Usage

import subprocess, os, sys

def run_trivy_offline_scan(target_file, output_file, cache_dir='/root/trivy-cache'):
    db_path = os.path.join(cache_dir, "db", "trivy.db")
    if not os.path.exists(db_path):
        print(f"[!] Database not found at {db_path}")
        sys.exit(1)

    command = [
        "trivy", "fs", target_file,
        "--format", "json",
        "--output", output_file,
        "--scanners", "vuln",
        "--skip-db-update",
        "--offline-scan",
        "--cache-dir", cache_dir
    ]

    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        print(result.stderr)
        sys.exit(1)
    return output_file

JSON Output Structure

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": { "nvd": { "V3Score": 9.8 } }
        }
      ]
    }
  ]
}