OWASP CVE Lite CLI Hands the Scan to Coding Agents

OWASP’s CVE Lite CLI is now a Lab Project that writes skill files so coding agents can scan lockfiles and produce copy-ready fixes. Maintainer Sonu Kapoor built it for JavaScript and TypeScript only. The current package is cve-lite-cli 1.34.0 on npm, published on September 9, 2026.

Launch write-ups treated it as a terminal-side npm audit. The command that changed the user is install-skill.

Coding Agents Get a Ready-Made CVE Skill

Run cve-lite install-skill once in a repo root and the CLI writes skill files for five AI assistants. Claude Code, Codex CLI, Gemini CLI, Cursor, and GitHub Copilot then know how to run a scan, read the JSON, and draft a fix plan without a custom prompt.

THE FIVE AGENT FILES

The docs tell you to commit those files. Anyone who clones the repo and opens it in a supported agent inherits the workflow. A second run replaces the CVE Lite section and leaves the rest of AGENTS.md or copilot-instructions.md alone.

The intended loop is mechanical. cve-lite. --json writes a timestamped scan file. In Claude Code you invoke /cve-lite; in the other tools the rule is picked up when you ask about flaws. The skill tells the agent to rank critical before high, direct before transitive, and to treat usage.imported === false as lower practical risk without dropping the row. If runnableFixCommand is present, that string is the command to run.

Kapoor said on July 17, 2026 that CVE Lite CLI had been accepted into Anthropic’s Claude for Open Source Program. That is the quiet shift. The first reader of a lockfile scan is increasingly an agent that already has a rule file in the tree, not a human waiting on a CI email.

The Scan Stops at the Lockfile

CVE Lite CLI is a metadata scanner. It does not upload source, the dependency tree, or credentials. Online it still talks to advisory APIs. Offline it does not.

The parser looks for package-lock.json (npm v1, v2, and v3), pnpm-lock.yaml (v5, v6, and v9), yarn.lock (Classic and Berry), then bun.lock. If several lockfiles sit in the same root, that is the priority order. A package.json fallback exists, and it only covers exact pinned direct versions such as "lodash": "4.17.20". Ranges, tags, and git URLs are skipped because the resolved version is unknown.

Advisory matching uses two sources in sequence, then dedupes. The primary is Google’s OSV API. Starting with v1.32.0, packages with zero OSV hits are checked against the npm registry advisory API, a pass that is skipped in offline mode and non-fatal on error. For air-gapped boxes the project says cve-lite advisories sync ingests roughly 217,000 advisory records in under nine seconds, 9.9 times faster than the first implementation, after which --offline makes no runtime advisory calls.

Repeated scans hit a local cache at ~/.cache/cve-lite/osv-vulns.json. Package-to-advisory query hits expire after 30 minutes; full advisory records do not. --usage annotates whether a flagged package is imported in source. --only-used keeps that subset.

Kapoor has said the useful split is which findings are direct, which are transitive, which can be fixed now, and which need a broader dependency decision. On one of his own two-pass cleanups, findings went from 39 to 18 and the high-severity item cleared.

Where npm Audit Stops Short

npm audit is already on every npm machine and needs no install. Google’s OSV-Scanner reads the same OSV data across many languages and can rewrite an npm lockfile with osv-scanner fix. CVE Lite CLI stays in JavaScript and TypeScript and spends its depth on package-manager-native commands, parent chains, and agent hooks.

CVE LITE CLI AGAINST TWO FREE SCANNERS

On a NestJS lockfile scanned June 24, 2026 at revision cee51af with CVE Lite CLI v1.25.0, the project’s case study reported 51 findings against npm audit’s 56. CVE Lite labelled 8 as direct and 43 as transitive. --only-used cut the set to 10. A first pass on fastify@5.8.5 left 50 findings. A second pass on mocha@12.0.0-beta-4 left 47. That beta target is worth sitting with: a copy-ready command can point at a pre-release.

The same NestJS tree, counted the way Google’s OSV-Scanner project prints it, produced 66 vulnerability rows across 35 packages. CVE Lite grouped those packages into 35 findings. Neither tally is a scoring error. OSV-Scanner lists advisories. CVE Lite lists packages you might bump.

For npm lockfiles the CLI checks whether a known clean child already fits inside the current parent range. If it does, the printed command is npm update <parent>, not npm install vulnerable-child@fixed. Kapoor put the failure mode in plain words on July 27, 2026: most scanners tell you to upgrade the parent to fix a transitive CVE even when the newer parent still pulls the vulnerable version. v1.28.0 started verifying the resolved tree before recommending that bump.

Four Tiers, One Copy-Ready Command

v1.33.0, tagged September 1, 2026, added an EPSS priority signal. FIRST.org’s Exploit Prediction Scoring System estimates how likely a CVE is to be exploited in the next 30 days relative to all published CVEs. CVE Lite combines that percentile with CVSS-derived severity into four EPSS priority tiers.

EPSS PRIORITY TIERS

• fix_now: Critical or high severity and EPSS in the top 10 percent; compact mode flags these inline as Fix Now.
• fix_soon: Critical or high severity, EPSS not in the top 10 percent.
• monitor: Medium or lower severity, EPSS in the top 10 percent.
• low_priority: Medium or lower severity, EPSS not in the top 10 percent.

JSON stores the tier as null when a finding has no CVE alias that resolves against FIRST’s API. Terminal and HTML cells then show a dash. --verbose adds EPSS columns; --report builds a local HTML dashboard with the same legend and copy-ready commands. --fix still only applies validated direct upgrades, then rescans. Transitive work stays on the parent path.

CVE Lite CLI Patched Its Own fflate Bug

On September 4, 2026, Kapoor said the project’s GitHub Action had opened a security fix pull request on the OWASP GitHub repository for CVE Lite CLI overnight. The finding was CVE-2026-45820 in fflate, one of the CLI’s four runtime dependencies alongside yaml, yarn-lockfile, and better-sqlite3. Findings went from 2 to 0. The pull request is #1073.

The tool patched itself. That’s the goal.

Sonu Kapoor, CVE Lite CLI maintainer, on X

CVE Lite CLI opened a security fix PR on its own repo while I was sleeping.

Found CVE-2026-45820 in fflate, validated the fix, opened the PR. Findings: 2 → 0.

The tool patched itself. That's the goal.https://t.co/Gx9k2AjmfD

— Sonu Kapoor (@SonuKapoor1978) September 4, 2026

That loop is what v1.26.0 wired for other repos: a first-party GitHub Action that can scan on a schedule, apply validated upgrades, and open one batched pull request with advisory IDs, before and after counts, and OSV-confirmed fix versions. Dependabot still opens one pull request per package. The Action needs contents: write and pull-requests: write. CI gating without writes is --fail-on high, plus --sarif for GitHub Code Scanning and --sbom spdx or CycloneDX for an SBOM that carries the findings. SPDX output is version 2.3.

Release tags after v1.12.1 are GPG-signed annotated tags. Kapoor’s private key stays on his machine, not on GitHub, npm, or CI. GitHub release tarballs also carry Sigstore artifact attestations.

Overrides Rot Faster Than Advisories Arrive

A lockfile can be clean against OSV and still be held in place by a stale overrides or resolutions pin. CVE Lite audits eleven classes of that rot across npm, pnpm, Yarn, and Bun. cve-lite. overrides is hygiene only and can run offline. --check-overrides appends the same rules to a CVE scan.

WHAT OVERRIDE HYGIENE CATCHES

• OA001: Override for a package that is no longer in the tree.
• OA002: Pin to a moving tag such as latest or next.
• OA004: The rest of the tree has already moved past the pin.
• OA008: A vulnerable copy still on disk despite the override.
• PD002: Source imports a package that exists only as a transitive dependency.

--check-maintenance is the cousin signal. DM001 flags a direct dependency that blocks a transitive CVE fix behind a major bump (high) and direct packages npm has marked deprecated (medium). Last-release age is printed when a package has gone quiet for more than two years; age alone does not change severity. Offline mode skips deprecation lookups and keeps the drag findings.

Fix commands also read release cooldowns the project already set. After the September 2025 chalk and debug compromise sat live for about two hours, npm, pnpm, and Yarn added gates (min-release-age, minimumReleaseAge, npmMinimalAgeGate). If a recommended fix is newer than that window, the CLI warns and does not change the exit code. License scanning is a separate pass: LC001 for copyleft families including GPL, AGPL, and LGPL, LC002 for undeclared licenses. On npm that data comes from the lockfile. On pnpm, Yarn, and Bun, only direct dependencies are checked.

OWASP Lab Rank Still Leaves the Upgrade to You

FROM INCUBATOR TO LAB

1. May 2026: OWASP lists CVE Lite CLI as an Incubator project, MIT licensed, no account required.
2. July 17, 2026: Kapoor says the package has passed 25,000 npm downloads since March and names users at Moody’s, France’s DINUM, Discord, and the government of British Columbia, plus the Claude for Open Source acceptance.
3. Late July 2026: The README and npm page call it an OWASP Lab Project. OWASP describes Lab projects as experimental, emerging tools, a rung below Production and Flagship.
4. September 1, 2026: v1.33.0 ships the EPSS priority signal.
5. September 4, 2026: The Action opens PR 1073 for CVE-2026-45820 in fflate.
6. September 9, 2026: npm publishes 1.34.0. Kapoor reports 692 GitHub stars.

Documented scans include OWASP Juice Shop, NestJS, Visual Studio Code, Gatsby, Storybook, Ghost CMS, and the Vercel AI SDK. Parser work for deno.lock and the older binary bun.lockb is still on the Phase 3 roadmap; JSONC bun.lock is already full support. Google’s scanner remains the broader free choice if the repo is not JavaScript.

Kapoor has spent 25 years as a developer and still frames the product as a local feedback loop, not a cloud dashboard. The skill file can rank fix_now rows and paste a command. It cannot absorb a major parent bump, a beta mocha line, or an abandonware pin that has no advisory and no newer release. That last decision stays with whoever owns the lockfile, human or agent.