CVE Lite CLI
A free, open-source OWASP project that scans your project's lockfile for known vulnerabilities and hands you copy-and-run fix commands — dependency security that lives in your terminal instead of buried in a CI dashboard you check once a week.
🔗 Visit CVE Lite CLI
Description
Dependency vulnerabilities usually surface in a CI pipeline report days after you've already moved on to other work, or worse, get caught by a security team long after code has shipped. CVE Lite CLI brings that check to where you're already working — your terminal, before you push — a bit like a spell-checker for your dependencies that flags problems while you're still writing, not after the document's been sent.
CVE Lite CLI is a free, open-source (MIT) tool and an official OWASP Incubator Project, maintained under OWASP governance. It reads your project's lockfile (npm, pnpm, Yarn, Bun), matches packages against the OSV vulnerability database, and distinguishes direct from transitive dependencies so you know exactly which of your own choices introduced a risk versus which came in through something else. It generates copy-and-run fix commands scoped to your package manager, works offline with a cached advisory database, audits override hygiene, flags maintenance risk, and can output an HTML dashboard or SARIF for GitHub Code Scanning, plus a GitHub Action with batched PR fix mode.
💬 Our review
The short version: if you want dependency vulnerability scanning that fits into a quick terminal check rather than a CI dashboard you have to remember to look at, CVE Lite CLI is a free, OWASP-governed tool built specifically for that workflow.
Compared to a CI-only scanner like Dependabot or Snyk's free tier, CVE Lite CLI's differentiator is running locally and offline, with actionable fix commands generated on the spot rather than a web dashboard you check separately — useful for a quick pre-push habit. Its OWASP Incubator Project status also means it follows a transparent, community-reviewed governance model rather than being a single company's commercial product with a free tier.
The honest limits: it's JavaScript/TypeScript-only for now (npm, pnpm, Yarn, Bun), so it won't help with Python, Go, or other ecosystems, and at under 1,000 GitHub stars it's newer and smaller than established players like Snyk or Dependabot, meaning less battle-testing and integration polish. For a JS/TS developer who wants a fast, free, offline-capable pre-push vulnerability check, it's a solid pick; for multi-language organizations needing one unified scanner across every stack, a broader commercial tool remains more practical.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Open source (licence MIT), projet OWASP Incubator, gratuit.
Pros
Scan local et hors-ligne, avec commandes de correction prêtes à copier-coller
Distingue dépendances directes et transitives pour cibler la vraie source du risque
Projet OWASP Incubator — gouvernance transparente et revue par la communauté
Sortie SARIF pour GitHub Code Scanning + GitHub Action avec correctifs groupés en PR
Cons
Limité à l'écosystème JavaScript/TypeScript (npm, pnpm, Yarn, Bun) pour l'instant
Projet plus jeune et plus petit (moins de 1000 étoiles) que Snyk ou Dependabot
Pas de couverture multi-langage pour des organisations avec plusieurs stacks