CVE Lens

A local vulnerability research tool for package versions and public GitHub repositories. Explore dependency advisories, compare severity scores, and inspect the evidence behind each finding.

Built with Node.js and plain JavaScript. No runtime dependencies or build step required.

Features

• Search exact package versions through OSV and GitHub Advisory.
• Deduplicate CVE, GHSA, and other advisory aliases.
• Enrich CVEs with CVE Program scores, CISA KEV status, and FIRST EPSS estimates; fetch NVD scores on demand.
• Discover public repositories by keyword and rank loaded results by detected dependency severity.
• Pin dependency scans to a commit SHA and link findings to source files.
• Search indexed commit messages for security signals.
• Report skipped items, unsupported formats, failed checks, and partial coverage explicitly.
• Scan a local project folder or selected dependency files through the same OSV matching engine.

Quick start

Requires Node.js 22 or newer, a modern browser, and internet access for live lookups.

1. Clone or download the repository and open its directory.
2. Optionally copy .env.example to .env and add a GitHub token.
3. Run npm start.
4. Open http://127.0.0.1:8787.

On Windows, double-click Start.cmd to start the server and open the browser. You can also run .Start.ps1 in PowerShell. On Linux or macOS, run chmod +x start.sh once, then ./start.sh. The portable command on every platform is npm start. Keep the server running while using the application and stop it with Ctrl+C. No npm install is needed.

Publish safely to GitHub

The repository is designed to be public. Before the first commit:

1. Copy .env.example to .env only on your machine and put the token in .env.
2. Never commit .env, GitHub tokens, cookies, private repository files, logs, or copied API responses. .gitignore excludes .env, logs, dependencies, and local screenshots.
3. Review the staged file list with git diff --cached --name-only and search staged text with git grep -n -I -E 'ghp_|github_pat_|GITHUB_TOKEN=|Bearer |api[_-]?key|secret' -- ':!*.lock'.
4. If a token was ever committed, revoke it in GitHub immediately; deleting the file in a later commit does not remove it from history.

From the project directory, create the repository and push it with:

git init
git add .
git diff --cached --name-only
git commit -m "Initial public release"
git branch -M main
git remote add origin https://github.com/YOUR-USER/cve-lens.git
git push -u origin main

Create an empty public repository on GitHub first, without adding a README, license, or .gitignore; those files already exist here. Enable Dependabot or secret scanning in the repository settings after pushing. The GitHub Actions test workflow runs on every push and pull request.

GitHub token and rate limits

Public lookups work without a token, but authentication increases the API allowance. Create a token in GitHub settings, then set it in your local .env:

GITHUB_TOKEN=your_token_here

Use a fine-grained token with Public repositories and no additional permissions, or a classic token with no scopes selected. The application supports public repositories only.

Restart the server after editing .env. Existing environment variables take precedence. Tokens are sent only to api.github.com, never to the browser or other providers. .env is excluded from Git; commit only the empty .env.example template.

GitHub requests run sequentially. Identical concurrent GET requests are shared, and successful responses are cached in memory for 15 minutes. Rate-limit responses trigger a cooldown based on retry/reset headers. Wait until the displayed time, then select Scan remaining repositories. Keep the page open to retain results. Authentication does not remove all API limits.

Usage

The interface uses three horizontal scan modes: Local Project Scan, Scan By Library, and Advanced GitHub Scan. Switching modes hides the other work area while preserving its in-memory results. The tabs support keyboard navigation with the arrow keys, Home, and End.

Local project

Select Select project folder to discover supported dependency files, or Upload dependency files for individual manifests and lockfiles. Review the file list and select Scan dependencies. Folder selection depends on browser support; individual file upload is also available.

The browser filters out node_modules, vendor, .git, .venv, venv, dist, and build. Npm lockfiles take precedence over package.json in the same directory. Only supported dependency files are read and sent to the loopback server. Their contents are not saved to disk. The server sends package names and exact versions to OSV; local file paths and full file contents are not sent to OSV. NVD score requests remain available on demand in finding details.

Limits: 20 files, 2 MB per file, 8 MB combined, and 500 unique versions. Additional files and unsupported formats are reported in the selection notes. Prefer package-lock.json over package.json: ranges such as ^1.2.3 are skipped because the tool does not install packages or resolve versions. A local scan does not require GitHub access or a GitHub token, but OSV lookups require internet access. Use Stop after current request to retain completed results; start again to retry the selection.

Single package

Select an ecosystem, enter the published package name and an exact version, then select Find vulnerabilities. Maven uses groupId:artifactId; Go uses the full module path. The built-in examples intentionally reference old versions for research, not installation recommendations.

Repository discovery

Search up to five keywords, matching all or any words in names or across names, descriptions, README files, and topics. Results include forks. Each page loads five repositories; automatic scans inspect up to four supported files and 120 exact versions on the default branch.

GitHub initially ranks by relevance. Loaded results are reordered by highest severity, highest available CVSS score, and advisory count. Stars and commit messages do not affect scores. Unassessed repositories receive no numeric score. GitHub exposes at most 1,000 results per query; narrow large searches.

Detailed pipeline

Enter owner/repository or a public GitHub URL, optionally selecting a branch or tag. Choose dependencies, commits, or both. Dependency reads are pinned to a resolved commit SHA. The selected branch does not restrict commit search.

Commit search supports security, CVE, GHSA, vulnerability, XSS, prototype pollution, and SQL injection, with an optional package term. Leave the repository blank in commit-only mode to search across GitHub. Matches are textual signals for manual review; diffs are not analyzed.

Supported dependency files

• npm: package-lock.json versions 1–3 and npm-shrinkwrap.json; exact versions in package.json when no npm lockfile exists in the same directory.
• Python: exact == versions in requirements*.txt and .txt files inside requirements directories; Pipfile.lock.
• PHP: composer.lock.
• .NET: resolved versions in packages.lock.json.

Supported nested files include production and development dependencies, examples, and tests. Lockfiles can include transitive dependencies. Packages are not installed and repository code is not executed. Version ranges and local or Git dependencies are not resolved. Environment markers and extras are not evaluated; included requirements files are not followed automatically.

Repository scans currently do not support Yarn, pnpm, Cargo, Go, Poetry, uv, Maven, Gradle, or Gem dependency formats. Single-package lookup supports additional ecosystems independently of these parsers.

Limits and interpretation

• Detailed scans: 20 files, 500 unique versions, 2 MB per file, batches of 40 versions.
• Advisory details: up to 200 IDs per batch; missing details or additional OSV pages produce partial coverage.
• Pipeline enrichment: up to 80 CVE IDs; remaining results retain available OSV scores.
• Commit search: up to 50 recent indexed results, with incomplete results reported.
• Single-package queries: up to 20 advisory pages per source.
• Scan sessions: up to ten sessions held in memory for one hour. Results are not saved to disk.

Ranking uses the highest available CVSS score, with source and version shown in details. CVSS 3.0/3.1 base scores can be calculated from vectors; CVSS 4 uses published numeric scores. Missing numeric scores fall back to source severity labels or remain unknown. KEV and EPSS do not change CVSS scores.

No findings does not establish safety, confirm package existence, or cover unpublished vulnerabilities. A dependency match does not establish exploitability or code reachability. Fixed versions may belong to different release branches; review the advisory before upgrading. A public repository is not necessarily open source.

Data sources and privacy

• OSV: version matching and advisory details.
• GitHub Advisory: independent package advisory queries.
• CVE Program records: CNA/ADP scores and record status.
• CISA KEV: known exploitation status.
• FIRST EPSS: estimated exploitation probability within 30 days.
• NVD: additional scores on demand, with a seven-second request interval.

Repository names and search terms are sent to GitHub. Package names and versions go to advisory providers; CVE IDs go to enrichment providers. Repository code is not uploaded to OSV. Coverage varies and aggregated databases can overlap.

The server binds to 127.0.0.1 for local use. It is not a hosted multi-user service. See SECURITY.md.

Development

Run npm test. Tests use fixtures and mocked responses, requiring no token or network access. GitHub Actions runs the suite on Node.js 22 and 24.

Optional live checks require a running server on port 8787 and internet access:

node live-check.js
node pipeline-live-check.js

These consume API allowance and can fail when provider data or availability changes. The pipeline check deliberately uses an old Express tag.

fixtures/local-project/package.json is an intentionally old dependency fixture for testing file and folder selection. Do not install its dependencies.

server.js serves the API; remote.js handles authentication, caching, and cooldowns; core.js normalizes advisories and scores; pipeline.js parses dependency files; repository-search.js and repo-risk.js implement discovery and ranking. The interface uses index.html, style.css, and the three UI scripts.

Contributing and license

See CONTRIBUTING.md. Licensed under MIT.