Why a third scanner • Use cases • Input • Output • Pricing

OSV-Scanner Vulnerability Checker

Fast, lockfile-based CVE checks for any public repo — real matches from OSV.dev, Google's open vulnerability database.

Verified live against pallets/flask: 27 real vulnerabilities found across its celery example's requirements.txt, correctly attributed to the exact manifest file that caused them.

Why a third scanner

OSV.dev aggregates PyPI Advisory DB, GitHub Security Advisories, npm advisories, RustSec, and the Go vulnerability database into one open, community-curated feed with precise affected-version-range data. Reading directly from lockfiles — instead of a full filesystem scan — makes this fast and low-noise: a useful independent cross-check alongside the Trivy and Grype scanners in this catalog, not a duplicate of either.

Use cases

• Fast pre-commit / pre-PR check — lockfile-only scanning is quick enough to run on every pull request without slowing CI down.
• Multi-ecosystem monorepo audits — one scan covers npm, pip, Go, Rust, and more in a single pass across a polyglot repo.
• Cross-check Trivy/Grype findings — an independent third data source to confirm (or catch what the others miss on) a CVE.
• Dependency upgrade planning — see exactly which manifest file and package version triggers each finding, and what fixes it.
• Open source contribution review — quickly vet a project's dependency health before contributing or forking.
• Security posture reporting — track vulnerability count trends over time as a lightweight recurring health check.

Input

Field	Type	Required	Notes
target	string	yes	Public git repo URL
severityFilter	array	no	Restrict results to given severities

{ "target": "https://github.com/owner/repo" }

Output

One row per real vulnerability match (ID, aliases, package, ecosystem, installed version, severity, fixed versions, advisory link), plus one scan_summary row with totals by severity and which manifest files were scanned.

One real vulnerability from a live scan against pallets/flask:

{
  "findingType": "vulnerability",
  "target": "https://github.com/pallets/flask",
  "sourceFile": "examples/celery/requirements.txt",
  "pkgName": "click",
  "pkgEcosystem": "PyPI",
  "installedVersion": "8.1.3",
  "vulnerabilityId": "PYSEC-2026-2132",
  "aliases": ["CVE-2026-7246", "GHSA-47fr-3ffg-hgmw"],
  "severity": "UNKNOWN",
  "severityScore": "CVSS:3.1/A..."
}

Frequently asked questions

How does this differ from Trivy and Grype in the same catalog? It reads dependency manifests directly (requirements.txt, package-lock.json, go.sum, etc.) rather than doing a full filesystem or image scan, so it's faster and scoped to declared dependencies. OSV.dev is also a distinct data source from what Trivy and Grype use, so results are a genuine independent cross-check, not a duplicate.

Which manifest files does it read? Whatever OSV-Scanner itself supports — common ones include requirements.txt, package-lock.json, yarn.lock, go.sum, Gemfile.lock, and Cargo.lock. It scans the whole repo tree, not just the root.

What does severity: UNKNOWN mean? Not every OSV.dev advisory carries a normalized severity rating — some only publish a CVSS vector string (as in the example above) without OSV's own severity bucket. The severityScore field still gives you the underlying CVSS vector to interpret yourself.

Can it scan a container image, not just a repo? No — this Actor is scoped to git repos and their dependency manifests. For container image scanning, use Trivy Security Scanner or Grype Vulnerability Matcher in the same catalog.

Limitations

• Only public git repos are supported — no container image scanning.
• Findings are scoped to what's declared in lockfiles/manifests; a vulnerable transitive dependency not captured in a lockfile won't be caught.
• Some advisories carry only a CVSS vector string rather than a normalized severity label (see FAQ above).

Start scanning

Give it a public repo URL and run it — pair it with Trivy or Grype on the same target if you want image-level coverage alongside manifest-level checks.

Pricing

Pay per completed scan (Pay-Per-Event) — $0.49 per scan, charged once the scan finishes regardless of how many matches are fou

Related Actors

Part of a five-Actor security scanning catalog: Trivy Security Scanner, Gitleaks Secret Scanner, Syft SBOM Generator, Grype Vulnerability Matcher.