pip-audit for Python Dependency Vulnerability Scanning

pip-audit is an open-source Python security tool that checks installed packages and project dependencies for publicly known vulnerabilities. It uses vulnerability data from sources such as the Python Packaging Advisory Database and the Open Source Vulnerabilities (OSV) service to identify affected package versions and available fixes.

Developed by Trail of Bits with support from Google, pip-audit helps developers identify vulnerable dependencies before they become a security risk. It supports local Python environments, requirements files, and software bill of materials (SBOM) generation. Google’s support does not make pip-audit an official Google product.

Key Features of pip-audit

• Environment auditing: Scan installed Python packages and project dependencies for known vulnerabilities.
• Requirements file support: Audit dependencies listed in one or more requirements-style files.
• Multiple vulnerability sources: Query supported services such as PyPI and OSV.
• SBOM generation: Export dependency information in CycloneDX JSON or XML formats.
• Flexible output: Generate human-readable tables or machine-readable JSON reports.
• Local cache support: Reuse the existing pip HTTP cache where applicable.
• Dependency remediation: Use the --fix option to attempt upgrades for packages with known vulnerabilities.
• Configurable audits: Specify installation paths, package indexes, timeouts, and other audit options.

How to Install pip-audit

pip-audit can be installed using pip. The original project documentation specifies Python 3.7 or newer; check the current release requirements before installing it in an older environment.

python -m pip install pip-audit

Users of Conda can also install the package through the conda-forge channel:

conda install -c conda-forge pip-audit

Third-party packages may have separate maintenance and support policies. Consult the relevant package manager documentation if you use an alternative distribution.

Getting Started with pip-audit

Run pip-audit directly or invoke it as a Python module to view the available options:

pip-audit --help
python -m pip_audit --help

Audit the Current Python Environment

To check installed dependencies in the active Python environment, run:

pip-audit

The tool reports known vulnerabilities when it finds affected packages. A clean result means no known vulnerabilities were detected in the audited dependencies, not that the environment is completely secure.

Scan a Requirements File

Use the -r option to audit dependencies listed in a requirements file:

pip-audit -r requirements.txt

You can supply the option multiple times to include additional requirements files. To limit results to packages in the local environment, use:

pip-audit -r requirements.txt --local

Audit a Local Python Project

Pass the project directory to scan its supported project metadata. The documented project-file support includes pyproject.toml, so check the installed version’s documentation for current compatibility.

pip-audit .

Useful pip-audit Options

For example, generate a JSON report with vulnerability descriptions:

pip-audit -f json --desc on

To preview which dependencies might be upgraded without applying fixes, use:

pip-audit --fix --dry-run

Review proposed upgrades before applying them. Version changes can introduce compatibility issues, so test the application after remediation.

Understanding Results and Exit Codes

pip-audit uses exit codes to communicate the outcome of an audit. In the documented behavior, exit code 0 indicates that no known vulnerabilities were detected, while exit code 1 indicates that one or more known vulnerabilities were found. Other failures may have different outcomes depending on the version and error condition.

Reports identify affected packages, installed versions, vulnerability identifiers, and available fixed versions when that information exists. For example, an outdated Flask release may be associated with multiple vulnerability records and more than one recommended upgrade path. Confirm the appropriate fixed version against the project’s compatibility requirements and current advisories.

Security Considerations and Limitations

pip-audit checks dependency trees against known vulnerability data. It is not a static code analyzer and does not inspect application logic for every possible security flaw. It also cannot guarantee protection against malicious packages, undisclosed vulnerabilities, or compromised package sources.

Dependency auditing may involve resolving packages and interacting with package indexes. Treat untrusted requirements files and package sources carefully, and follow the official project’s security guidance. An audit of a requirements file should not be treated as a completely isolated or risk-free operation.

For additional dependency security checks, see our guide to Gitleaks for detecting exposed secrets. You can also consult the official pip-audit GitHub repository for installation instructions, supported options, and updates.

Download and documentation: pip-audit project on GitHub.