Overview

OSV-Scanner is a powerful Go-based vulnerability scanner that leverages the comprehensive data from the open-source OSV database (osv.dev) to identify vulnerabilities affecting your project's dependencies. It acts as an officially supported frontend to the OSV database and offers a robust CLI interface to OSV-Scalibr for connecting your project's dependency list with known security risks. With broad support for various languages, package managers, operating systems, and container images, OSV-Scanner provides accurate and actionable insights to streamline your vulnerability management and remediation efforts.

Key Features

• Extensive Ecosystem Support: Scans vulnerabilities across a wide array of languages including C/C++, Dart, Elixir, Go, Java, JavaScript, PHP, Python, R, Ruby, and Rust, supporting popular package managers like npm, pip, yarn, maven, Go modules, cargo, gem, composer, and nuget.
• Container Image Scanning: Detects vulnerabilities in OS packages and language-specific dependencies within container images, providing layer-aware analysis.
• Operating System Vulnerability Detection: Identifies vulnerabilities in OS packages on Linux systems.
• Guided Remediation (Experimental): Offers intelligent suggestions for package version upgrades based on criteria like dependency depth, severity, fix strategy, and ROI, with support for in-place, relock, and override strategies for npm and Maven.
• License Scanning: Checks the licenses of your dependencies using deps.dev data and allows you to enforce an allowed license list.
• Offline Scanning: Enables scanning against a locally downloaded OSV database, eliminating the need for a constant network connection after initial setup.
• Call Analysis: Reduces false positives by determining if a vulnerable function is actually in use within your project.
• Vendored C/C++ Code Detection: Scans vendored C/C++ code for potential vulnerabilities.
• Open and Authoritative Data: Utilizes advisories from trusted sources like GitHub Security Advisories and the RustSec Advisory Database, ensuring high-quality and community-driven vulnerability information.

Typical Use Cases

• CI/CD Integration: Integrate OSV-Scanner into your continuous integration and continuous delivery pipelines to automatically detect vulnerabilities in code changes before deployment.
• Dependency Auditing: Regularly audit your project's dependencies to identify and prioritize risks associated with known vulnerabilities.
• Container Security: Scan container images used in your infrastructure to ensure they are free from common vulnerabilities in base images and installed packages.
• Compliance and Governance: Use license scanning to ensure your project adheres to licensing requirements and avoid potential legal issues.
• Proactive Vulnerability Management: Leverage guided remediation to efficiently update vulnerable dependencies and minimize your project's attack surface.
• Offline Development Environments: Maintain security scanning capabilities even in environments with limited or no network access.