How to Fix a Trivy CVE Vulnerability in requirements.txt

How Trivy's filesystem scan works

trivy fs walks your project files looking for dependency manifests (requirements.txt, go.sum, package-lock.json, etc.) and cross-references every version against the NVD/OSV advisory database. With --exit-code 1 and --severity CRITICAL, it returns a non-zero exit code the moment it finds a CRITICAL-severity CVE - which is the standard CI gate pattern.

# See the full finding with the Fix Version column
trivy fs --severity CRITICAL .

# CI gate - exits 1 if any CRITICAL is found, exits 0 if clean
trivy fs --severity CRITICAL --exit-code 1 .

The output table has five columns: Library, Vulnerability, Severity, Installed Version, and Fixed Version. The Fixed Version column is the source of truth - it tells you the minimum patched release.

Reading the finding

A typical CRITICAL finding looks like this:

requirements.txt
================
Library   Vulnerability    Severity  Installed  Fixed
--------- ---------------- --------- ---------- -------
pyyaml    CVE-2020-14343   CRITICAL  5.3.1      5.4

CVE-2020-14343 is an arbitrary code execution vulnerability in PyYAML's FullLoader - it deserializes arbitrary Python objects from untrusted YAML input. It was patched in 5.4 by restricting the default loader.

Fixing it: bump the pin

Open requirements.txt and update the vulnerable line. A range pin is fine; an exact pin is more reproducible:

# before
pyyaml==5.3.1

# after - range is acceptable
pyyaml>=5.4

# or pin the exact patched release for full reproducibility
pyyaml==5.4.1

Re-run the gate:

trivy fs --severity CRITICAL --exit-code 1 .
# exit code 0 - no CRITICAL findings

Why this pattern matters in CI

The hard part of dependency CVE management is not the one-line fix - it is making the gate fail CI reliably so old pins cannot drift back in. Once trivy fs --exit-code 1 is in the pipeline:

• Any future pull request that introduces a vulnerable pin will fail before merge.
• You can add --severity CRITICAL,HIGH to also block HIGH-severity findings as your risk tolerance tightens.
• Combine with trivy image to also catch CVEs baked into the base OS layer of your Docker image - a clean requirements.txt does not mean a clean image.

To automate bumps, layer Renovate or Dependabot on top: they open PRs whenever a newer patched version is available, so you review and merge rather than hunt manually.