google/osv-scanner

What is it?

Key features

• 01Scans source directories for supported lockfiles and manifests across many languages.
• 02Scans container images, including OS packages and language artifacts.
• 03Checks dependency licenses against an allowed SPDX list.
• 04Runs offline against a locally downloaded OSV database.
• 05Suggests package upgrades for npm and Maven projects through an experimental fix command.

Use cases

• Checking a project's dependencies for known vulnerabilities before a release.
• Scanning container images in a CI pipeline to catch vulnerable base images or packages.
• Auditing dependency licenses against an organization's allowed list.
• Scanning in air-gapped environments using a locally stored vulnerability database.

Quick start

1. 1

   Install with Go (builds from source)

   go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
2. 2

   Scan a source directory for vulnerabilities

   osv-scanner scan source -r /path/to/your/dir

Things to know

• !The README describes this as the V2 beta, so interfaces may still change.
• !Guided remediation (the fix command) is experimental and can run package manager scripts on untrusted projects.

In collections

Topics

FAQ

What is osv-scanner?

A Go CLI that scans your project's dependencies and container images against the OSV vulnerability database to report known vulnerabilities. OSV-Scanner connects a project's list of dependencies with known vulnerabilities from the OSV database at osv.dev. Point it at a source directory and it recursively finds supported package files such as package.json, go.mod, and pom.xml, then reports the vulnerabilities that affect the listed versions. It can also scan container images, checking operating system packages on Alpine, Debian, and Ubuntu along with language dependencies for Go, Java, Node, and Python.

Is osv-scanner free to use? What license does it have?

osv-scanner is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is osv-scanner still maintained?

Actively maintained. The last commit to osv-scanner was on Nov 7, 2026.

What can I use osv-scanner for?

Checking a project's dependencies for known vulnerabilities before a release. Scanning container images in a CI pipeline to catch vulnerable base images or packages. Auditing dependency licenses against an organization's allowed list. Scanning in air-gapped environments using a locally stored vulnerability database.

How do I install osv-scanner?

Install with Go (builds from source): go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest Scan a source directory for vulnerabilities: osv-scanner scan source -r /path/to/your/dir

Where can I get osv-scanner?

The source code and installation instructions are on GitHub: https://github.com/google/osv-scanner