Does This CVE Affect Me? I Built an AI Agent That Shows Its Evidence

说明与用途

开发者构建了一个本地工具，用于验证特定 CVE 是否适用于 npm 包的某个版本，并返回证据、修复和源链接。

问题

Developers need a way to verify if a specific CVE applies to a package version and see evidence and fixes.

结果

The assistant provides a concise, evidence‑backed answer with links to original advisories, enabling developers to verify CVE applicability quickly.

工作流

• Enter package name, optional version, and CVE question on the Research page
• Run research to query OSV and the Sanity Knowledge Base
• Review the overview for affected ranges and fixes
• Check the Coverage tab to confirm all sources completed
• Inspect the Sources tab for original advisory links
• Review the Activity tab for operation details
• Upload a package‑lock.json to the Dependencies tab
• View exact dependency matches and advisory links

证据

I built AI Security Advisory Assistant, an evidence-first tool for researching known vulnerabilities in npm packages.

来源

The app returns documented affected ranges, source-listed fixes, deployment conditions to verify, and links to original advisories.

来源

The Coverage tab records the resolved npm package, how many live advisories were retrieved and matched, whether the Knowledge Base check completed, and the timing of each source.

来源

The app parses the JSON as data; it does not install packages or run scripts.

来源