CVE Lens：基于 Gemma 4 的 OWASP CVE Lite CLI 配套仪表盘

A Gemma 4-powered companion dashboard for OWASP CVE Lite CLI.

CVE Lite CLI is a fast, local-first JS/TS dependency vulnerability scanner: it reads your lockfile, matches OSV advisories, and tells you exactly what to run to fix things. CVE Lens adds the layer it deliberately does not have — a modern dashboard and a Gemma 4 assistant that explains, prioritizes, and plans, grounded strictly in engine output.

Engine: OWASP CVE Lite CLI (MIT, OWASP Lab Project) — consumed as a dependency, never forked. License: MIT (this repository).

Highlights

• Dashboard — severity cards (counts, direct vs transitive), vulnerability-mix and exposure charts, blast-radius stats, automated-remediation console, rendered + raw Markdown audit report, dark mode.
• Findings explorer — the 173-finding fixture renders clean; severity/scope filters, search across packages / CVE ids / summaries / parents, sort by severity, package, or EPSS, expandable rows with full dependency paths and copy-ready fix commands.
• Gemma 4 explanations — per-finding plain-English summary, why it matters, and project impact, built from scan fields only, schema-validated, and cached (data/cache/explain) so repeat requests are instant.
• Gemma 4 triage — every finding gets fix-now / fix-soon / monitor / low with auditable reasoning citing real fields; malformed model output is rejected and falls back to a deterministic heuristic.
• Local-first AI — the default mode runs Gemma 4 on your machine via Ollama; nothing leaves your machine. Gemini API mode is opt-in.

Hard rule: Gemma explains, ranks, and plans only — it never invents, removes, or upgrades a finding. Every model response is grounded in engine output and validated before it reaches the UI.

What's original here

Status

Hackathon build (October 2026). Done: engine adapter, dashboard shell + findings explorer, Gemma 4 client (local + API modes), grounded explainer, triage agent, demo script + engine smoke CI. In progress: dependency graph, fix plan + export, chat. Live task board and progress log: TODO.md; strategy: docs/PLAN.md.

Quickstart (dev)

npm ci
npm run dev        # http://localhost:3000

The dashboard auto-loads fixtures/scan.sample.json — 173 real findings from the upstream examples/gatsby fixture — so it works on a fresh clone with no scan.

Scan your own project with the engine:

npx cve-lite-cli /path/to/project --json --output scans

Demo

bash scripts/demo.sh          # clones OWASP/cve-lite-cli, scans examples/gatsby, prints report paths
npm run dev                   # dashboard auto-loads the newest scan from scans/

scripts/demo.sh works from a clean clone: it installs dependencies if missing, runs the real engine (npx cve-lite-cli) against the upstream examples/gatsby example app, writes scans/<timestamp>.json + -report.md, and prints both paths. Pass a directory to scan your own app instead: bash scripts/demo.sh /path/to/project.

Screenshots

Overview — severity mix, exposure, blast radius, remediation:

Findings explorer with a Gemma 4 explanation (real local model output):

Dark mode:

AI setup (Gemma 4)

Local mode (default):

ollama pull gemma4     # Gemma 4 (E4B)
cp .env.example .env   # AI_MODE=local

On low-disk / low-RAM machines, pull the lighter tag and point OLLAMA_MODEL at it: ollama pull gemma4:e2b (4.6 GB) → OLLAMA_MODEL=gemma4:e2b.

Gemini API mode (opt-in): set AI_MODE=api, GEMINI_API_KEY, and GEMMA_MODEL (the Gemma 4 model id) in .env.

Checks

npm run lint && npm test && npm run build

85 tests across engine parsing, severity helpers, Markdown generation, findings filtering/sorting, the Gemma client (both modes, mocked), the explainer (grounding, validation, cache), and triage (schema validation, batching, fallback).

Architecture

See docs/ARCHITECTURE.md. Short version:

Next.js UI (app/, components/)
   ├── lib/engine.ts    → npx cve-lite-cli <path> --json   (execFile, no shell interpolation)
   ├── lib/findings.ts  → filtering / sorting (pure, unit-tested)
   ├── lib/explain.ts   → grounded prompts + validation + cache (data/cache)
   ├── lib/triage.ts    → batched tiers + per-batch heuristic fallback
   └── lib/gemma.ts     → generateJson<T>: Ollama (default) | Gemini API (opt-in)

app/api/explain and app/api/triage are the only model boundaries: they validate input, call the Gemma layer, validate output, and never trust raw model text.

Team

• Pranesh Nikhar — @praneshnikhar
• Anmol — @anmol-thedev
• Prx — @Prx-my

License

MIT — see LICENSE.