cve-bin-tool

cve-bin-tool Plugin

cve-bin-tool scans binaries, archives, firmware images, and directories to detect embedded open-source components and match them against CVE databases (NVD, OSV, GAD, REDHAT, CURL). No source code needed — it fingerprints 400+ components by strings/versions.

Commands

Scanning

• cve-bin-tool scan run <path> — Scan a file, directory, or archive
• cve-bin-tool database update — Force-refresh the local CVE database
• cve-bin-tool _ _ — Passthrough (--exclude, --vex-file, --input-file, -S severity filters)

Usage Examples

• "Scan this firmware image for known CVEs"
• "Which components in this directory have critical vulnerabilities"
• "Generate a JSON CVE report for this binary"
• "Check this SBOM for vulnerabilities"

Installation

pipx install cve-bin-tool
# or: pip install cve-bin-tool

Examples

cve-bin-tool /path/to/binary_or_dir
cve-bin-tool --format json -o report.json firmware.img
cve-bin-tool --sbom spdx --sbom-file app.spdx.json   # audit an SBOM
cve-bin-tool --offline /path                        # skip DB update
cve-bin-tool -S HIGH /path                          # only high+ severity

Key Features

• Detects 400+ components (openssl, zlib, curl, nginx, busybox...) in binaries and images
• Multiple CVE sources: NVD, OSV, GitLab Advisory DB, REDHAT, CURL
• Outputs console, CSV, JSON, HTML, PDF, SARIF, and CycloneDX reports
• Accepts SPDX/CycloneDX SBOMs and language lockfiles as input; supports VEX triage