Trivy offline vulnerability scanning

Trivy Offline Vulnerability Scanning

Scan dependency files for known vulnerabilities using Trivy's offline mode, which avoids network calls by using a pre-downloaded vulnerability database.

Workflow

1. Run Trivy in Offline Mode

Key flags for offline filesystem scanning:

Flag	Purpose
fs <target>	Scan a dependency file (e.g., package-lock.json)
--format json	Output structured JSON for parsing
--output <file>	Save results to a file
--scanners vuln	Only scan for vulnerabilities (skip misconfigs)
--skip-db-update	Do not attempt to update the vulnerability DB
--offline-scan	Enable fully offline mode
--severity HIGH,CRITICAL	Filter by severity at scan time

2. Example Command

trivy fs /root/package-lock.json \
  --format json \
  --output /root/trivy_report.json \
  --scanners vuln \
  --skip-db-update \
  --offline-scan \
  --severity HIGH,CRITICAL

3. JSON Output Structure

Trivy outputs vulnerability data in this structure:

{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": {
            "nvd": { "V3Score": 9.8 },
            "ghsa": { "V3Score": 9.8 }
          }
        }
      ]
    }
  ]
}

Troubleshooting

• "failed to initialize DB": Database not found — check --cache-dir path or re-download
• No results when vulns expected: Database may be outdated — update before going offline
• "command not found: trivy": Trivy not installed or not in PATH