cve-reachability-analyzer

Post-Disclosure CVE Reachability Analyzer

Overview

This skill performs static analysis of software repositories to determine whether disclosed CVEs in dependencies are reachable from the project's code. It analyzes import patterns, call chains, dynamic invocation, and configuration to classify each CVE's reachability with evidence-based justification.

Workflow

Step 1: Gather Input Information

Collect and validate the required information:

1. Repository analysis:

   • Identify programming language(s)
   • Locate dependency files (package.json, requirements.txt, pom.xml, etc.)
   • Understand project structure and entry points

2. CVE information:

   • CVE ID and description
   • Affected package name and version range
   • Vulnerable component (function/class/method)
   • Vulnerability type (injection, overflow, etc.)
   • Fixed version

3. Configuration information (optional):

   • Feature flags and their states
   • Build profiles (dev/staging/production)
   • Environment variables
   • Runtime configuration files

Step 2: Verify Dependency Presence

Check if the vulnerable dependency exists in the project:

1. Parse dependency files:

   • Read language-specific dependency files (see language_guide.md)
   • Extract package names and version constraints
   • Build dependency tree (including transitive dependencies)

2. Version matching:

   • Compare installed version against vulnerable version range
   • Check if version falls within affected range
   • Identify if fixed version is available

3. Early exit:

   • If package not present → Not Applicable
   • If version not in vulnerable range → Not Vulnerable
   • Otherwise, proceed to Step 3

Step 3: Analyze Import Patterns

Determine if vulnerable components are imported:

1. Search for imports:
   • Find all import/require/using statements for the vulnerable package
   • Check for direct imports of vulnerable function/class
   • Identify wildcard imports that may include vulnerable component
   • Look for aliased imports