CLI Commands

cnspec vuln

Scan a target asset for known vulnerabilities.

Scan an asset for known vulnerabilities (CVEs) and get a report of what needs patching. Unlike cnspec scan, which checks policy compliance, cnspec vuln focuses specifically on identifying vulnerable packages and software with known security issues. By default, cnspec scans the local system:

cnspec vuln local

You can also scan remote targets:

cnspec vuln ssh user@HOST

cnspec builds an SBOM of the asset locally and sends it to Mondoo Platform, which returns the matching vulnerabilities as Vulnerability Exchange (VEX) documents. The scan is ephemeral: nothing is stored in Mondoo Platform. Because the analysis runs in Mondoo Platform, cnspec must be registered. Without credentials, cnspec warns you to run cnspec login and exits without a vulnerability report.

cnspec vuln [flags]
cnspec vuln [command]

Options

      --discover strings        Enable the discovery of nested assets. Supports: all, auto, container, container-images, mcp-servers
  -h, --help                    help for vuln
      --inventory-ansible       Set the inventory format to Ansible
      --inventory-domainlist    Set the inventory format to domain list
      --inventory-file string   Set the path to the inventory file
  -o, --output string           Set the output format: compact, csv, full, hdf, json, json-v1, json-v2, junit, ocsf-json, ocsf-parquet, report, sarif, summary, yaml, yaml-v1, yaml-v2 (default "full")
      --platform-id string      Select a specific target asset by providing its platform ID
      --record string           Record all resource calls and use resources in the recording
      --sudo                    Elevate privileges with sudo
      --use-recording string    Use a recording to inject resource data (read-only)

Options inherited from parent commands

      --api-proxy string        Set the proxy for communications with Mondoo Platform API
      --auto-update             Enable automatic provider installation and update (default true)
      --config string           Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string        Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string   Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --strict                  Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                 Enable verbose output

SEE ALSO

cnspec version

Display the installed cnspec version.

cnspec

The cnspec CLI is a cloud-native security testing tool for assessing the security of your entire infrastructure.

On this page

OptionsOptions inherited from parent commandsSEE ALSO