Skip to main content

vulkro match-cve

Pro

vulkro match-cve is part of Pro: SBOM CVE matching (match-cve), match an external SBOM against the offline CVE bundle. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Match a Software Bill of Materials against the local CVE bundle and emit findings. Companion to vulkro sbom: produce the SBOM once, then run CVE matching on it whenever the bundle updates. Accepts CycloneDX 1.5 / 1.6 or SPDX 2.3 JSON input.

Offline-safe: reads only the SBOM file and the local CVE bundle. No network calls.

Usage​

vulkro match-cve --sbom ./sbom.json

Flags​

FlagDescription
--sbom <FILE>Path to the SBOM JSON file (CycloneDX 1.5 / 1.6 or SPDX 2.3). Required.
--format <FORMAT>json (default, an array of finding records) or table (human-readable).

Exit codes​

  • 0 success, no findings.
  • 1 findings emitted.
  • 2 IO error.

Examples​

# Produce the SBOM once.
vulkro sbom . --format cyclonedx > sbom.json

# Re-match whenever the CVE bundle refreshes.
vulkro update
vulkro match-cve --sbom sbom.json --format table

Command reference​

Generated from vulkro help match-cve on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Check a package list (SBOM) against the local vulnerability data.

[Pro] Match a Software Bill of Materials against the local CVE bundle and emit findings. Companion to `vulkro sbom`: produce the SBOM once, then run CVE matching on it whenever the bundle updates. Accepts CycloneDX 1.5 / 1.6 or SPDX 2.3 JSON input.

Offline-safe: the match reads only the SBOM file and the local CVE bundle at `~/.vulkro/data/cves/`. Your SBOM, its component list, and the resulting findings never leave the machine. Like every scanning subcommand this one passes the license gate, which can fire the anonymous usage heartbeat (at most once per 24h, on a background thread); `VULKRO_OFFLINE=1` silences it.

Exit code: 0 success no findings, 1 findings emitted, 2 IO error.

Usage: vulkro match-cve [OPTIONS] --sbom <FILE>

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --sbom <FILE>
          Path to the SBOM JSON file (CycloneDX 1.5 / 1.6 or SPDX 2.3)

      --format <FORMAT>
          Output format. `json` (default) or `table` for human reading

          Possible values:
          - json:  Pretty-printed JSON: an array of finding records
          - table: Human-readable table on stdout
          
          [default: json]

  -h, --help
          Print help (see a summary with '-h')
Last updated on