Vulnerability Editor

Vulnerability-Lookup supports two editors for creating and modifying vulnerability records:

• Vulniverse: A modular and extensible vulnerability record editor. Its functionality can be customized through optional panels, actions, and features.

• Vulnogram: A web-based editor providing a form-based interface for creating and editing CVE records.

The editor is an optional module, off by default. Turn it on in config/website.py:

WEB_MODULES = {
    # ...
    "vulnerability_editor": True,
}

The editor pages are:

• /vuln/create, for a new record;

• /vuln/<id>/edit, for an existing record.

The former /user/submit and /user/edit/<id> redirect there (301). The create page is under Advisories → New vulnerability advisory in the main menu.

When it is off:

• The editor pages, and the former URLs, answer 404.

• The “New vulnerability advisory” menu entry and the Edit button of records are not shown.

• The API of the editor (/api/vulniverse_templates, /api/vulniverse_record_quality, /api/patch2vuln) is not registered.

• The CNA API (/api/cna) still works, so API clients can create and update records.

When it is on, VULNERABILITY_EDITOR in config/website.py selects the editor:

VULNERABILITY_EDITOR = "vulniverse"  # the default, or "vulnogram"

An unknown value stops the website at start-up.

Configure Vulniverse

Vulniverse can be embedded into Vulnerability-Lookup and uses the host application’s existing services for loading and saving vulnerability records.

Fig. 9 Vulniverse Editor.

Vulniverse-specific settings are defined in config/vulniverse.json, located in the Vulnerability-Lookup config/ directory. This configuration controls which optional panels, actions, and features are available in the embedded editor.

Depending on the enabled functionality and the services provided by Vulnerability-Lookup, Vulniverse can offer capabilities such as record quality assessments, CPE recommendations, and AI-assisted vulnerability record generation.

Configure Patch2Vuln

Patch2Vuln is an optional service that uses large language models (LLMs) to generate vulnerability record drafts from software patches.

Vulnerability-Lookup does not run Patch2Vuln: it forwards the jobs to an external Patch2Vuln HTTP service and relays the results. To show the Patch2Vuln panel in Vulniverse:

1. Run a Patch2Vuln service that Vulnerability-Lookup can reach.

2. Configure it in config/patch2vuln.json:

   {
     "patch2vuln_enabled": true,
     "patch2vuln_url": "http://<host>:<port>",
     "patch2vuln_timeout": 300,
     "api_key": ""
   }
   

   • patch2vuln_enabled: registers /api/patch2vuln. The panel is only shown when it is true.

   • patch2vuln_url: the address of the service.

   • patch2vuln_timeout: in seconds, how long to wait for the result of a job.

   • api_key: the token the service expects, if any. The PATCH2VULN_API_TOKEN environment variable takes precedence, to keep the secret out of the file.

3. Enable the panel in config/vulniverse.json: "patch2vuln": true under panels.

4. Restart the website: the panel and the endpoint are set up at start-up.

The panel needs both patch2vuln_enabled and panels.patch2vuln. With patch2vuln_enabled on and the service unreachable, jobs fail with “Could not reach the Patch2Vuln service”.

Once configured, users can submit patches for analysis directly in Vulniverse. The generated vulnerability information can be reviewed before being selectively applied to the current record.

Use Vulnogram

Set both settings in config/website.py, then restart the website:

WEB_MODULES = {
    # ...
    "vulnerability_editor": True,
}

VULNERABILITY_EDITOR = "vulnogram"

• Both are needed: with vulnerability_editor off, the editor routes answer 404 whatever VULNERABILITY_EDITOR says.

• config/vulniverse.json and config/patch2vuln.json are not used.

• The Vulniverse API (/api/vulniverse_templates, /api/vulniverse_record_quality, /api/patch2vuln) is not registered.