docker_scout_cves.yaml

command: docker scout cves
short: Display CVEs identified in a software artifact
long: |-
    The docker scout cves command analyzes a software artifact for vulnerabilities.

    If no image is specified, the most recently built image is used.

    The following artifact types are supported:

    - Images
    - OCI layout directories
    - Tarball archives, as created by docker save
    - Local directory or file
    - SPDX file or in-toto attestation file with SPDX predicate

    The tool analyzes the provided software artifact, and generates a vulnerability report.

    By default, the tool expects an image reference, such as:

    - redis
    - curlimages/curl:7.87.0
    - mcr.microsoft.com/dotnet/runtime:7.0

    If the artifact you want to analyze is an OCI directory, a tarball archive, a local file or directory,
    or if you want to control from where the image will be resolved, you must prefix the reference with one of the following:

    - image:// (default) use a local image, or fall back to a registry lookup
    - local:// use an image from the local image store (don't do a registry lookup)
    - registry:// use an image from a registry (don't use a local image)
    - oci-dir:// use an OCI layout directory
    - archive:// use a tarball archive, as created by docker save
    - fs:// use a local directory or file
    - sbom:// use an SBOM as SPDX file or in-toto attestation file with SPDX predicate or syft json SBOM file
usage: docker scout cves [OPTIONS] [IMAGE|DIRECTORY|ARCHIVE]
pname: docker scout
plink: docker_scout.yaml
options:
    - option: details
      value_type: bool
      default_value: "false"
      description: Print details on default text output
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: env
      value_type: string
      description: Name of environment
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: epss
      value_type: bool
      default_value: "false"
      description: |
        Display the EPSS scores and organize the package's CVEs according to their EPSS score
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: epss-percentile
      value_type: float32
      default_value: "0"
      description: |
        Exclude CVEs with EPSS scores less than the specified percentile (0 to 1)
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: epss-score
      value_type: float32
      default_value: "0"
      description: |
        Exclude CVEs with EPSS scores less than the specified value (0 to 1)
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: exit-code
      shorthand: e
      value_type: bool
      default_value: "false"
      description: Return exit code '2' if vulnerabilities are detected
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: format
      value_type: string
      default_value: packages
      description: |-
        Output format of the generated vulnerability report:
        - packages: default output, plain text with vulnerabilities grouped by packages
        - sarif: json Sarif output
        - spdx: json SPDX output
        - gitlab: json GitLab output
        - markdown: markdown output (including some html tags like collapsible sections)
        - sbom: json SBOM output
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: ignore-base
      value_type: bool
      default_value: "false"
      description: Filter out CVEs introduced from base image
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: ignore-suppressed
      value_type: bool
      default_value: "false"
      description: |
        Filter CVEs found in Scout exceptions based on the specified exception scope
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: local
      value_type: bool
      default_value: "false"
      description: Local mode
      deprecated: false
      hidden: true
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: local-vulndb
      value_type: string
      description: Local vulnerability database
      deprecated: false
      hidden: true
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: locations
      value_type: bool
      default_value: "false"
      description: Print package locations including file paths and layer diff_id
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: multi-stage
      value_type: bool
      default_value: "false"
      description: Show packages from multi-stage Docker builds
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-base
      value_type: bool
      default_value: "false"
      description: Only show CVEs introduced by the base image
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-cisa-kev
      value_type: bool
      default_value: "false"
      description: Filter to CVEs listed in the CISA KEV catalog
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-cve-id
      value_type: stringSlice
      default_value: '[]'
      description: |
        Comma separated list of CVE ids (like CVE-2021-45105) to search for
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-fixed
      value_type: bool
      default_value: "false"
      description: Filter to fixable CVEs
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-metric
      value_type: stringSlice
      default_value: '[]'
      description: |
        Comma separated list of CVSS metrics (like AV:N or PR:L) to filter CVEs by
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-package
      value_type: stringSlice
      default_value: '[]'
      description: Comma separated regular expressions to filter packages by
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-package-type
      value_type: stringSlice
      default_value: '[]'
      description: |
        Comma separated list of package types (like apk, deb, rpm, npm, pypi, golang, etc)
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-severity
      value_type: stringSlice
      default_value: '[]'
      description: |
        Comma separated list of severities (critical, high, medium, low, unspecified) to filter CVEs by
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-stage
      value_type: stringSlice
      default_value: '[]'
      description: Comma separated list of multi-stage Docker build stage names
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-unfixed
      value_type: bool
      default_value: "false"
      description: Filter to unfixed CVEs
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-vex-affected
      value_type: bool
      default_value: "false"
      description: Filter CVEs by VEX statements with status not affected
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: only-vuln-packages
      value_type: bool
      default_value: "false"
      description: |
        When used with --format=only-packages ignore packages with no vulnerabilities
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: org
      value_type: string
      description: Namespace of the Docker organization
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: output
      shorthand: o
      value_type: string
      description: Write the report to a file
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: platform
      value_type: string
      description: Platform of image to analyze
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: ref
      value_type: string
      description: |-
        Reference to use if the provided tarball contains multiple references.
        Can only be used with archive
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: stream
      value_type: string
      description: Name of stream
      deprecated: true
      hidden: true
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: vex
      value_type: bool
      default_value: "false"
      description: Apply VEX statements to filter CVEs
      deprecated: true
      hidden: true
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: vex-author
      value_type: stringSlice
      default_value: '[<.*@docker.com>]'
      description: List of VEX statement authors to accept
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: vex-location
      value_type: stringSlice
      default_value: '[]'
      description: File location of directory or file containing VEX statements
      deprecated: false
      hidden: false
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
inherited_options:
    - option: debug
      value_type: bool
      default_value: "false"
      description: Debug messages
      deprecated: false
      hidden: true
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
    - option: verbose-debug
      value_type: bool
      default_value: "false"
      description: Verbose debug
      deprecated: false
      hidden: true
      experimental: false
      experimentalcli: false
      kubernetes: false
      swarm: false
examples: "  Display vulnerabilities for the most recently built image\n  $ docker scout cves\e[0m\n\n  Display vulnerabilities grouped by package\n  $ docker scout cves alpine\e[0m\n\n  Display vulnerabilities from a docker save tarball\n  $ docker save alpine > alpine.tar\e[0m\n  $ docker scout cves archive://alpine.tar\e[0m\n\n  Display vulnerabilities from an OCI directory\n  $ skopeo copy --override-os linux docker://alpine oci:alpine\e[0m\n  $ docker scout cves oci-dir://alpine\e[0m\n\n  Display vulnerabilities from the current directory\n  $ docker scout cves fs://.\e[0m\n\n  Export vulnerabilities to a SARIF JSON file\n  $ docker scout cves --format sarif --output alpine.sarif.json alpine\e[0m\n\n  Markdown output, including HTML tags. To be used in Pull Request comments for instance.\n  $ docker scout cves --format markdown alpine\e[0m\n\n  List all Go packages of the image that are vulnerable\n  $ docker scout cves --format only-packages --only-package-type golang --only-vuln-packages golang:1.18.0\e[0m\n\n  List vulnerabilities from an SPDX file\n  $ syft -o spdx-json alpine | docker scout cves sbom://\e[0m"
deprecated: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false