Observe the exploitation evidence behind a CVE or package version — offline, in your terminal.
vulngraph compiles current vulnerability observations into an auditable
local snapshot, then answers checks with zero network access. It does not
score reputation or call an API per lookup — it reports the typed evidence
behind a verdict: CISA KEV listing, public exploits, EPSS probability, CVSS
severity, ATT&CK mappings, and OSV version ranges.
$ vulngraph CVE-2024-4577 CVE-2024-4577 verdict: ACTIVELY EXPLOITED (confidence 0.99) action: patch now reasons: CRITICAL_SEVERITY, KNOWN_EXPLOITED, MULTISOURCE_CORROBORATION, PUBLIC_EXPLOIT, … cvss: 9.8 epss: 100.0% kev: listed
curl -fsSL https://raw.githubusercontent.com/copyleftdev/vulngraph-cli/main/scripts/install.sh | sh vulngraph update # download + verify the latest data release (~54 MB)
Prebuilt binaries: x86_64-unknown-linux-musl, aarch64-apple-darwin. Or
cargo install --git https://github.com/copyleftdev/vulngraph-cli.
| Command | What it does |
|---|---|
vulngraph check <target>… |
Verdict + evidence for each target. <target> is CVE-YYYY-NNNN, ecosystem:name@version (e.g. npm:[email protected]), or a path to a lockfile whose dependencies are each checked. |
vulngraph status |
Installed snapshot, integrity, freshness. |
vulngraph update |
Download, verify, compile, and atomically activate a data release. --offline-dir DIR installs from local assets. |
vulngraph capabilities |
Commands, output schemas, guarantees, exit codes. |
vulngraph schema <name> |
Print a stable JSON Schema (command, observation, status). |
Global: --json (stable machine envelope), --offline (assert no network).
vulngraph CVE-2024-4577 is shorthand for vulngraph check ….
Point check at a dependency file and every package in it gets the same
verdict — no new command, just a file argument:
$ vulngraph check package-lock.json Scanned 214 package(s) 1 ACTIVELY EXPLOITED 4 PROOF OF CONCEPT 12 RECORDED 190 NOT AFFECTED 7 UNKNOWN Affected: ACTIVELY EXPLOITED npm:[email protected] (6 CVEs) PROOF OF CONCEPT npm:[email protected] (2 CVEs) …
Detected by filename: package-lock.json, yarn.lock, pnpm-lock.yaml,
Cargo.lock, Gemfile.lock, poetry.lock, requirements.txt, go.sum,
composer.lock, pom.xml, gradle.lockfile, Pipfile.lock. --json
emits the full per-package result array. You can mix files and individual
targets in one invocation.
Severity-ordered, and unknown is never rendered as clean — absence of
evidence is reported as absence, not safety.
| Disposition | Meaning | Action |
|---|---|---|
actively-exploited |
CISA KEV listed | patch now |
weaponized |
public exploit + EPSS ≥ 0.9 | patch now |
proof-of-concept |
≥1 public exploit | prioritize |
scored |
CVSS/EPSS present, no exploit | prioritize / monitor |
recorded |
in the graph, no risk signals | monitor |
not-affected |
package known, version outside every affected range | no action |
unknown |
not present in the snapshot | investigate |
| Code | Meaning |
|---|---|
| 0 | success (including unknown / not-affected — the tool observes, it doesn't gate) |
| 1 | operational or integrity error (no snapshot, corrupt data) |
| 2 | invalid invocation (bad target) |
| 4 | dataset too stale (> 14 days) — check refuses to answer |
- Offline checks. Only
updatetouches the network. Everything else reads the local snapshot. - Verified data. Every install verifies asset checksums, per-file hashes, and a recomputed snapshot identity against the release manifest, then sanity-opens the graph before activating. A failed update never replaces the last verified snapshot.
- Deterministic. Same snapshot + same target → same verdict. No clock, no randomness in the policy.
- Stable JSON.
--jsonemitsvulngraph.command.v1wrappingvulngraph.observation.v1; the shapes are versioned and validated in CI.
Data is published by
vulngraph-data as
immutable data-YYYYMMDD GitHub Releases aggregating CVE List V5, EPSS,
CISA KEV, ExploitDB / PoC-in-GitHub / Nuclei, MITRE ATT&CK, and OSV/GHSA.
This CLI installs those artifacts; it does not build the graph.
MIT licensed.