DocsSecurityCVE Detection

CVE Detection

Lunx queries the OSV (Open Source Vulnerability) database against your exact installed package versions before every build. Results in under 300ms — no external tools needed.

How CVE detection works

The Lunx CVE engine reads your package lockfile (package-lock.json, pnpm-lock.yaml, or yarn.lock) to obtain the exact resolved version of every installed dependency. It then batches these package identifiers and queries the Open Source Vulnerability (OSV) database — the same database used by GitHub Dependabot and Google's supply chain security tools.

Severity levels

Severity	CVSS Score	Default behavior
Critical	9.0 – 10.0	Build aborted immediately
High	7.0 – 8.9	Build aborted (default threshold)
Moderate	4.0 – 6.9	Warning logged, build continues
Low	0.1 – 3.9	Info logged only

Example output

bash

lunx security cve

🔍 CVE check — querying OSV database...
   Lockfile: package-lock.json (312 packages resolved)
   Query time: 284ms

   Results:
   ✗ HIGH:     lodash@4.17.20
               CVE-2021-23337 — Prototype pollution via zipObjectDeep
               Fixed in: 4.17.21
               → Run: lunx security fix

   ⚠ MODERATE: follow-redirects@1.15.1
               CVE-2023-26159 — Open redirect vulnerability
               Fixed in: 1.15.4

   ✓ 310 packages — no vulnerabilities found

   Summary: 0 critical · 1 high · 1 moderate · 0 low
   Exit code: 1 (high severity found)

Auto-fixing vulnerabilities

bash

# Interactive upgrade — shows diffs before applying
lunx security fix

🔧 Fixing 2 vulnerabilities...

  lodash: 4.17.20 → 4.17.21
  Changelog: https://github.com/lodash/lodash/releases/tag/4.17.21
  Breaking changes: none
  Apply? (y/N): y ✓

  follow-redirects: 1.15.1 → 1.15.6
  Changelog: https://github.com/follow-redirects/...
  Breaking changes: none
  Apply? (y/N): y ✓

  ✓ package.json updated
  ✓ Run "npm install" to apply changes

Configuration

typescriptlunx.config.ts

export default defineConfig({
  security: {
    checkCVEs: true,

    // Abort build at this severity or above
    failOnSeverity: 'high',   // 'low' | 'moderate' | 'high' | 'critical'

    // Allowlist specific CVEs (with justification comment)
    ignoreVulnerabilities: [
      'GHSA-35jh-r3h4-6jhm',  // false positive — not in code path
    ],
  }
})

OSV database coverage

The OSV database covers vulnerabilities from GitHub Advisory Database, NVD, PyPI, npm, Go, Rust crates, and 15+ additional ecosystems. It is updated continuously and is the most comprehensive open-source vulnerability database available.

PreviousSecret Scanning NextSBOM Guide