Grype Command Line Reference

A vulnerability scanner for container images, filesystems, and SBOMs.

Supports the following image sources:
    grype yourrepo/yourimage:tag             defaults to using images from a Docker daemon
    grype path/to/yourproject                a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory

You can also explicitly specify the scheme to use:
    grype podman:yourrepo/yourimage:tag          explicitly use the Podman daemon
    grype docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
    grype docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
    grype oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Podman or otherwise)
    grype oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
    grype singularity:path/to/yourimage.sif      read directly from a Singularity Image Format (SIF) container on disk
    grype dir:path/to/yourproject                read directly from a path on disk (any directory)
    grype file:path/to/yourfile                  read directly from a file on disk
    grype sbom:path/to/syft.json                 read Syft JSON from path on disk
    grype registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
    grype purl:path/to/purl/file                 read a newline separated file of package URLs from a path on disk
    grype PURL                                   read a single package PURL directly (e.g. pkg:apk/openssl@3.2.1?distro=alpine-3.20.3)
    grype CPE                                    read a single CPE directly (e.g. cpe:2.3:a:openssl:openssl:3.0.14:*:*:*:*:*)

You can also pipe in Syft JSON directly:
 syft yourimage:tag -o json | grype

Usage:
  grype [IMAGE] [flags]
  grype [command]

Available Commands:
  completion  Generate a shell completion for Grype (listing local docker images)
  config      show the grype configuration
  db          vulnerability database operations
  explain     Ask grype to explain a set of findings
  help        Help about any command
  version     show version information

Flags:
      --add-cpes-if-none       generate CPEs for packages with no CPE data
      --by-cve                 orient results by CVE instead of the original vulnerability ID when possible
  -c, --config stringArray     grype configuration file(s) to use
      --distro string          distro to match against in the format: <distro>:<version>
      --exclude stringArray    exclude paths from being scanned using a glob expression
  -f, --fail-on string         set the return code to 1 if a vulnerability is found with a severity >= the given severity, options=[negligible low medium high critical]
      --file string            file to write the default report output to (default is STDOUT)
  -h, --help                   help for grype
      --ignore-states string   ignore matches for vulnerabilities with specified comma separated fix states, options=[fixed not-fixed unknown wont-fix]
      --name string            set the name of the target being analyzed
      --only-fixed             ignore matches for vulnerabilities that are not fixed
      --only-notfixed          ignore matches for vulnerabilities that are fixed
  -o, --output stringArray     report output formatter, formats=[json table cyclonedx cyclonedx-json sarif template], deprecated formats=[embedded-cyclonedx-vex-json embedded-cyclonedx-vex-xml]
      --platform string        an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')
      --profile stringArray    configuration profiles to use
  -q, --quiet                  suppress all logging output
  -s, --scope string           selection of layers to analyze, options=[squashed all-layers deep-squashed] (default "squashed")
      --show-suppressed        show suppressed/ignored vulnerabilities in the output (only supported with table output format)
      --sort-by string         sort the match results with the given strategy, options=[package severity epss risk kev vulnerability] (default "risk")
  -t, --template string        specify the path to a Go template file (requires 'template' output to be selected)
  -v, --verbose count          increase verbosity (-v = info, -vv = debug)
      --version                version for grype
      --vex stringArray        a list of VEX documents to consider when producing scanning results

Use "grype [command] --help" for more information about a command.

Usage:
  grype config [flags]
  grype config [command]

Available Commands:
  locations   shows all locations and the order in which grype will look for a configuration file

Flags:
  -h, --help   help for config
      --load   load and validate the grype configuration

Usage:
  grype db check [flags]

Flags:
  -h, --help            help for check
  -o, --output string   format to display results (available=[text, json]) (default "text")

Usage:
  grype db delete [flags]

Flags:
  -h, --help   help for delete

Usage:
  grype db import FILE | URL [flags]

Flags:
  -h, --help   help for import

Usage:
  grype db list [flags]

Flags:
  -h, --help            help for list
  -o, --output string   format to display results (available=[text, raw, json]) (default "text")

Usage:
  grype db providers [flags]

Flags:
  -h, --help            help for providers
  -o, --output string   format to display results (available=[table, json]) (default "table")

Usage:
  grype db search [flags]
  grype db search [command]

Examples:

  Search for affected packages by vulnerability ID:

    $ grype db search --vuln ELSA-2023-12205

  Search for affected packages by package name:

    $ grype db search --pkg log4j

  Search for affected packages by package name, filtering down to a specific vulnerability:

    $ grype db search --pkg log4j --vuln CVE-2021-44228

  Search for affected packages by PURL (note: version is not considered):

    $ grype db search --pkg 'pkg:rpm/redhat/openssl' # or: '--ecosystem rpm --pkg openssl

  Search for affected packages by CPE (note: version/update is not considered):

    $ grype db search --pkg 'cpe:2.3:a:jetty:jetty_http_server:*:*:*:*:*:*:*:*'
    $ grype db search --pkg 'cpe:/a:jetty:jetty_http_server'

Available Commands:
  vuln        Search for vulnerabilities within the DB (supports DB schema v6+ only)

Flags:
      --broad-cpe-matching       allow for specific package CPE attributes to match with '*' values on the vulnerability
      --distro stringArray       refine to results with the given operating system (format: 'name', 'name@version', 'name@maj.min', 'name@codename')
      --ecosystem string         ecosystem of the package to search within
  -h, --help                     help for search
      --limit int                limit the number of results returned, use 0 for no limit (default 5000)
      --modified-after string    only show vulnerabilities originally published or modified since the given date (format: YYYY-MM-DD)
  -o, --output string            format to display results (available=[table, json]) (default "table")
      --pkg stringArray          package name/CPE/PURL to search for
      --provider stringArray     only show vulnerabilities from the given provider
      --published-after string   only show vulnerabilities originally published after the given date (format: YYYY-MM-DD)
      --vuln stringArray         only show results for the given vulnerability ID

Usage:
  grype db status [flags]

Flags:
  -h, --help            help for status
  -o, --output string   format to display results (available=[text, json]) (default "text")

Usage:
  grype db update [flags]

Flags:
  -h, --help   help for update

Usage:
  grype explain --id [VULNERABILITY ID] [flags]

Flags:
  -h, --help             help for explain
      --id stringArray   CVE IDs to explain

Usage:
  grype version [flags]

Flags:
  -h, --help            help for version
  -o, --output string   the format to show the results (allowable: [text json]) (default "text")