jue / examples /vex_dependency.json
Jue1Dev's picture
Jue: open-weight calibrated decision model for cybersecurity
d259245
Raw History Blame Contribute Delete
876 Bytes
{
"model": "jue-latest",
"state": {
"advisory": {
"id": "GHSA-example",
"package": "npm:lodash",
"vulnerable_range": "<4.17.21",
"patched": "4.17.21",
"vulnerable_function": "lodash.template"
},
"sbom_component": {
"name": "lodash",
"version": "4.17.15",
"scope": "runtime"
},
"reachability": "Static call graph: application imports lodash.merge and lodash.get only; no call path reaches lodash.template."
},
"questions": {
"version_affected": {
"type": "noul",
"instructions": "The installed version is inside the vulnerable range."
},
"vex_status": {
"type": "choice",
"instructions": "OpenVEX status for this product.",
"criteria": {
"affected": "affected",
"not_affected": "not_affected (vulnerable code not reachable)",
"fixed": "fixed",
"under_investigation": "under_investigation"
}
}
}
}