owasp/CVE Lite CLI
Run CVE Lite CLI in GitHub Actions for JS/TS dependency vulnerability scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 11, 2026
- License
- MIT
Pinned Snippet
uses: owasp/cve-lite-cli@99b7b0dcd4c687116890515dbfa8f955871776cc # v1.26.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| node-version | Node.js version used to install and run CVE Lite CLI | no | 24 |
| path | Project path to scan | no | . |
| fail-on | Exit non-zero at or above this severity | no | "" |
| all | Show all findings in the table regardless of severity threshold | no | false |
| verbose | Run the scan with verbose output | no | false |
| prod-only | Exclude dev dependencies where available | no | false |
| offline | Run the scan using the local advisory database | no | false |
| offline-db | Path to the local advisory database file | no | "" |
| sync-advisories | Build or refresh the local advisory database before scanning | no | false |
| usage | Scan source files to detect which vulnerable packages are actually imported | no | false |
| only-used | Only report findings for packages that are imported in source code (implies usage) | no | false |
| sarif | Write SARIF 2.1.0 output to a timestamped .sarif file for GitHub Code Scanning upload | no | false |
| no-cache | Skip the OSV query cache and fetch fresh results; defaults to true in CI | no | true |
| cdx | Write CycloneDX 1.4 SBOM to a timestamped .cdx.json file | no | false |
| ca-cert | Path to a PEM CA certificate file for corporate SSL inspection proxies | no | "" |
| version | CVE Lite CLI version to install (e.g. '1.23.1', '1', 'latest') | no | 1 |
| check-overrides | Run override hygiene checks (OA001-OA008) inline with the scan and surface findings in the same report | no | false |
| overrides | Run a dedicated 'cve-lite overrides' audit (OA001-OA008) as a separate step in addition to the scan | no | false |
| overrides-fail-on | Exit non-zero when the dedicated overrides audit finds an issue at or above this severity (used with overrides: true) | no | "" |
| check-network | Allow the override audit to make registry calls for the OA007 drift check; off by default in CI | no | false |
| audit-log | Stream override detection and fix events as NDJSON change-control to this path | no | "" |
| fix | Apply validated direct dependency upgrades automatically | no | false |
| create-pr | Open or update a pull request with the applied fixes (requires fix: true, and contents: write + pull-requests: write permissions on the workflow) | no | false |
| base-branch | Target branch for the fix PR. Auto-detects the repo default branch if empty. | no | "" |
| labels | Comma-separated labels to apply to the fix PR. Labels are created in the repo if they do not exist. | no | dependencies,security |
| token | GitHub token for creating the fix PR. Must have contents: write and pull-requests: write. Leave empty to use the workflow token. | no | "" |
| report | Write an HTML report to this directory path; --no-open is applied automatically in CI | no | "" |
Outputs
no outputs