trivy-offline-vulnerability-scanning git:20260424.d50cf5aA

Immutable. This exact content never changes and is served at /api/v1/blob/c04f07e62d91a527.

---
name: trivy-offline-vulnerability-scanning
description: Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files without internet access.
---

# Trivy Offline Vulnerability Scanning

## Setup

Trivy requires a pre-downloaded vulnerability database for offline scanning.

**Check database exists:**
```bash
ls /root/trivy-cache/db/
# Should show: trivy.db  metadata.json
```

## Key Flags

| Flag | Purpose |
|------|---------|
| `fs <target>` | Scan a file or directory |
| `--format json` | JSON output for parsing |
| `--output <file>` | Save results to file |
| `--scanners vuln` | Only vulnerability scanning |
| `--skip-db-update` | Do not update database (offline) |
| `--offline-scan` | Enable offline mode |
| `--cache-dir <path>` | Path to offline database |
| `--severity HIGH,CRITICAL` | Filter by severity |

## Usage

```python
import subprocess, os, sys

def run_trivy_offline_scan(target_file, output_file, cache_dir='/root/trivy-cache'):
    db_path = os.path.join(cache_dir, "db", "trivy.db")
    if not os.path.exists(db_path):
        print(f"[!] Database not found at {db_path}")
        sys.exit(1)

    command = [
        "trivy", "fs", target_file,
        "--format", "json",
        "--output", output_file,
        "--scanners", "vuln",
        "--skip-db-update",
        "--offline-scan",
        "--cache-dir", cache_dir
    ]

    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        print(result.stderr)
        sys.exit(1)
    return output_file
```

## JSON Output Structure

```json
{
  "Results": [
    {
      "Target": "package-lock.json",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-44906",
          "PkgName": "minimist",
          "InstalledVersion": "1.2.5",
          "FixedVersion": "1.2.6",
          "Severity": "CRITICAL",
          "Title": "Prototype Pollution in minimist",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-44906",
          "CVSS": { "nvd": { "V3Score": 9.8 } }
        }
      ]
    }
  ]
}
```