Skip to content

Releases: bstforom/vulnscan

Release list

VulnScan v1.0.1 — security fix: lock local mode to this machine

VulnScan v1.0.1 — security fix: lock local mode to this machine Latest
Latest

Choose a tag to compare

View all tags
@bstforom bstforom released this 19 Oct 06:02
v1.0.1
9313ed9

🔒 Security release: please update

Everyone running v1.0.0 should upgrade.

What was wrong

In v1.0.0, local mode (the default, with no login) listened on all network interfaces. As a result:

  • Anyone on the same network (Wi-Fi, office LAN, VM network) could open the dashboard, read reports, and launch scans from your machine, including scans of your internal network.
  • A malicious website could reach the local API through DNS rebinding, or submit a cross-site multipart form to /api/scan/file (CSRF).

What changed

  • The server now binds to 127.0.0.1 by default. Use the new HOST variable to change it.
  • VulnScan refuses to start on a non-loopback address unless REQUIRE_AUTH=1.
  • In local mode, requests whose Host is not localhost are rejected (DNS-rebinding protection), and so are state-changing requests from a foreign Origin (CSRF protection).
  • New tests cover these cases. 49 tests in total.

Upgrade

git pull
npm install
npm start

To expose VulnScan on a network on purpose, run it with authentication:

REQUIRE_AUTH=1 HOST=0.0.0.0 npm start

Full details are in the CHANGELOG.

Assets 2
Loading

VulnScan v1.0.0 — your own vulnerability scanner

VulnScan v1.0.0 — your own vulnerability scanner

Choose a tag to compare

View all tags
@bstforom bstforom released this 19 Oct 04:45
v1.0.0
478d43b

The first public release of VulnScan, a self-hosted vulnerability assessment platform you start with one npm start.

Highlights

  • 🎯 Website / IP scanning: security headers, cookies, TLS, CORS, HTTP methods, WAF detection, HTML and DNS checks, GraphQL, source maps and WordPress. Every finding is mapped to OWASP Top 10 + CWE.
  • 🧬 CVE intelligence: local SQLite + FTS5 database that scales to 100k+ CVEs (NVD), with CISA KEV flags, optional EPSS scores, and precise CPE version-range matching.
  • 📁 File & code scanning: dependency vulnerabilities via OSV (npm, PyPI, Maven, Go, Cargo, NuGet, Packagist, RubyGems, Pub, Hex), 30+ secret patterns, 35+ SAST rules.
  • 👀 Live scan log: watch every check as it runs.
  • ⏱️ Scheduled scans and a history diff that shows new vs. resolved findings.
  • 📄 HTML / JSON / SARIF 2.1.0 reports with one-click PDF export.
  • 🖥️ CLI with CI-friendly exit codes, plus a library API.
  • 🔐 Optional hardened authentication (scrypt, HIBP, CSRF, lockout). There are no default credentials.

Get started

git clone https://github.com/bstforom/vulnscan.git
cd vulnscan
npm install
npm start   # → http://localhost:3000

Requires Node.js 22+.

⚠️ Authorized use only. Scan only systems you own or have explicit written permission to test.

See the CHANGELOG for the full list.

Loading