pip-audit

A tool for scanning Python environments for known vulnerabilities

pip-audit Permissive license Active ★ 1,344 v2.10.1 released 2026-06-10

Install

pip-audit on PyPI

pip

pip install pip-audit

uv

uv add pip-audit

poetry

poetry add pip-audit

Package facts

License	not declared (permissive)
Python support	supports the current Python release (>=3.10)
Install friction	low — pure-Python wheel
Runtime dependencies	10 — CacheControl, cyclonedx-python-lib, packaging, pip-api, pip-requirements-parser, requests, rich, tomli, tomli-w, platformdirs
Maintenance	actively maintained — 64 days since the last release
Last repo commit	2026-08-12
First released	2021-09-16
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: pip_audit-2.10.1-py3-none-any.whl

Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Security

About pip-audit

from the package's own PyPI description — quoted content, verbatim

pip-audit

CI (image) PyPI version (image) Packaging status (image) OpenSSF Scorecard (image) License (image)

pip-audit is a tool for scanning Python environments for packages with known vulnerabilities. It uses the Python Packaging Advisory Database (https://github.com/pypa/advisory-database) via the PyPI JSON API as a source of vulnerability reports.

This project is maintained in part by Trail of Bits with support from Google. This is not an official Google or Trail of Bits product.

...

Read as markdown · JSON record · Source repository · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

pip-audit scans Python environments and requirements files for packages with known vulnerabilities using the Python Packaging Advisory Database, supporting multiple vulnerability services and output formats including SBOMs.

Low install friction with a pure-wheel distribution and 10 runtime dependencies. Actively maintained with a recent release (64 days ago) and steady repository activity; requires Python 3.10 or newer.

Licensed under Apache Software License (permissive), allowing broad use and modification with minimal restrictions.

Usage

pip install pip-audit
pip-audit
# or audit a specific requirements file:
pip-audit -r requirements.txt

Requires Python 3.10 or newer. Network access needed to query the Python Packaging Advisory Database.

Verdict: pip-audit is a well-maintained, actively developed security tool from the PyPA ecosystem with no known vulnerabilities, low installation friction, and permissive licensing. It is suitable for integration into CI/CD pipelines and local development workflows to detect vulnerable dependencies.

Needs verification

Whether the tool's automatic fix capability (--fix flag) reliably resolves all detected vulnerabilities without introducing breaking changes
Performance characteristics when auditing large dependency trees or monorepos

python vulnerability scannerdependency security auditpip vulnerability checkerpython package vulnerability detectionsecurity scanning requirementssbom generation pythonknown vulnerabilities checker