Filesystem

Scan a local project including language-specific files.

  1. $ trivy fs /path/to/project

Local Project

Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.

  1. $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test

Result

  1. 2020-06-01T17:06:58.652+0300    WARN    OS is not detected and vulnerabilities in OS packages are not detected.
  2. 2020-06-01T17:06:58.652+0300    INFO    Detecting pipenv vulnerabilities...
  3. 2020-06-01T17:06:58.691+0300    INFO    Detecting cargo vulnerabilities...
  5. Pipfile.lock
  6. ============
  7. Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0)
  9. +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+
  10. |       LIBRARY       | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |     FIXED VERSION      |               TITLE                |
  11. +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+
  12. | django              | CVE-2020-7471    | HIGH     | 2.0.9             | 3.0.3, 2.2.10, 1.11.28 | django: potential                  |
  13. |                     |                  |          |                   |                        | SQL injection via                  |
  14. |                     |                  |          |                   |                        | StringAgg(delimiter)               |
  15. +                     +------------------+----------+                   +------------------------+------------------------------------+
  16. |                     | CVE-2019-19844   | MEDIUM   |                   | 3.0.1, 2.2.9, 1.11.27  | Django: crafted email address      |
  17. |                     |                  |          |                   |                        | allows account takeover            |
  18. +                     +------------------+          +                   +------------------------+------------------------------------+
  19. |                     | CVE-2019-3498    |          |                   | 2.1.5, 2.0.10, 1.11.18 | python-django: Content             |
  20. |                     |                  |          |                   |                        | spoofing via URL path in           |
  21. |                     |                  |          |                   |                        | default 404 page                   |
  22. +                     +------------------+          +                   +------------------------+------------------------------------+
  23. |                     | CVE-2019-6975    |          |                   | 2.1.6, 2.0.11, 1.11.19 | python-django:                     |
  24. |                     |                  |          |                   |                        | memory exhaustion in               |
  25. |                     |                  |          |                   |                        | django.utils.numberformat.format() |
  26. +---------------------+------------------+----------+-------------------+------------------------+------------------------------------+
  27. ...