trivy-offline-vulnerability-scanning git:20260424.d50cf5aA

Immutable. This exact content never changes and is served at /api/v1/blob/d663f95aec17873f.

---
name: trivy-offline-vulnerability-scanning
description: Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files.
---

# Trivy Offline Vulnerability Scanning

## Overview
Trivy is a comprehensive security scanner that can detect vulnerabilities in OS packages and application dependencies. In offline mode, it uses a pre-downloaded vulnerability database.

## Key Commands

### Scan a package-lock.json file (offline, JSON output)
```bash
trivy fs --skip-db-update --skip-java-db-update \
  --format json \
  --scanners vuln \
  --pkg-types library \
  --severity HIGH,CRITICAL \
  /path/to/package-lock.json
```

### Important Flags
- `--skip-db-update`: Use the already-downloaded DB (offline mode)
- `--skip-java-db-update`: Skip Java DB update for non-Java projects
- `--format json`: Machine-readable output for downstream processing
- `--severity HIGH,CRITICAL`: Filter by severity level
- `--scanners vuln`: Only scan for vulnerabilities (skip misconfig, secret, etc.)
- `--pkg-types library`: Scan application libraries only

### Output Structure (JSON)
The JSON output contains a `Results` array. Each result has:
- `Target`: the scanned file
- `Vulnerabilities`: array of vulnerability objects with fields:
  - `PkgName`: package name
  - `InstalledVersion`: installed version
  - `VulnerabilityID`: CVE ID (e.g., CVE-2023-1234)
  - `Severity`: HIGH, CRITICAL, etc.
  - `CVSS`: object with scoring from multiple sources (nvd, ghsa, redhat)
  - `FixedVersion`: version that fixes the vulnerability (may be empty)
  - `Title`: short vulnerability title
  - `PrimaryURL`: reference URL
  - `Description`: longer description (use if Title is empty)