Cve Env

cve-env

**Agentic CVE → Docker environment builder.**

Given a CVE ID, cve-env builds a Docker environment running the affected application at its pre-patch version and verifies the build is correct. The agent researches each CVE live (NVD + OSV + GitHub + container registries) and picks its own build path.

Version: 1.0 beta Author: Gadi Evron (@gadievron)

---

What `success` means

`status="success"` requires **both**:

1. Right version — a version-assertion exec_check (pip show, dpkg -l, openssl version, find / -name '*.jar', …) proving the deployed binaries fall in the CVE's affected range.
2. Working app — functional-smoke checks proving normal operation on benign input (e.g. HTTP GET / + a content match, or a SELECT 1 roundtrip for a database).

If verify runs but that evidence is incomplete, the runtime records the honest fallback `verified_partial` instead. cve-env's job ends at a correct, working environment — it builds and verifies; it does not assess or attempt the vulnerability.

Every build runs in a hardened container: `--cap-drop ALL`, `--security-opt no-new-privileges:true`, ports bound to `127.0.0.1` only.

---

Requirements

• Python 3.12+ and uv
• A Docker daemon reachable via docker on PATH. Developed and tested against Colima; any Docker-compatible daemon (Docker Desktop, OrbStack, rootless Docker) should work but is untested
• The claude CLI, logged in — cve-env authenticates through your existing Claude Code session via claude-agent-sdk. No ANTHROPIC_API_KEY is consumed.

Install

git clone  && cd cve-env
uv sync

Quick start

# Build + verify one CVE (prints a per-stage report at the end)
uv run cve-env build CVE-2014-0160

# Probe external services (NVD, OSV, GitHub, Docker Hub, registries)
uv run cve-env doctor

Per-CVE audit traces (every tool call, result, and cost) are written to `output/agentic//