Usage
vg scan --vulns # drift score + known vulnerabilities
vg scan --full # drift + vulnerabilities + a banned-dependency report
What It Does
vg scan --vulns matches every installed dependency against the public OSV database and reports each known vulnerability — advisory id and CVE, severity, CVSS score, and the version that fixes it. Findings land in the scan artifact, in the terminal report, and in SARIF for CI code scanning. vg scan --full runs the same vulnerability pass plus a banned-dependency report (when a standards policy is committed) on top of the normal drift score.
Online and Offline
By default detection queries OSV over the network. For air-gapped environments, supply advisories in a package-version manifest and run offline:
vg scan --vulns --offline --package-manifest ./package-versions.zip
Supported Ecosystems
Detection reads each project's lockfile, so it covers npm / pnpm / yarn, pip / poetry / pipenv, cargo, composer, bundler, go, pub, hex, NuGet, and Maven/Gradle.
Severity and Findings
Each advisory is reported with a qualitative severity (low, moderate, high, critical) derived from its CVSS v3 vector, the fixing version when one is published, and the affected package and installed version. Critical and high findings are emitted as errors and moderate as warnings, so --fail-on gates work against vulnerabilities the same way they work against drift.
Output Formats
vg scan --vulns --format sarif --out vibgrate.sarif # GitHub Code Scanning / Azure DevOps
vg scan --vulns --format json --out scan.json # full artifact for automation
Exposure Attribution
In a git repository, each finding is attributed to the commit, author, and date that introduced the vulnerable version, with the number of days you have been exposed. See CRA remediation metrics and the vg why command.
In CI
vg scan --vulns --format sarif --out vibgrate.sarif --fail-on error
Upload the SARIF with the GitHub upload-sarif action to surface vulnerabilities in the Security tab.