SecPod

SecPod VEX Studio

Open source, guided VEX authoring tool for OSS maintainers

WHY USE VEX STUDIO

Generates SBOMs, scans packages for CVEs, and walks you through CWE-guided exploitability questions to decide whether a vulnerability is exploitable in your package’s context. It then produces auditable OpenVEX output your users can trust.

VEX Studio can also ensure faster compliance with the EU Cyber Resilience Act.

View on GitHub
01 GENERATE

Start from a real SBOM

Run VEX Studio against a repository. It builds an SBOM, matches every component against known CVEs, and hands you an actionable worklist, which is already prioritized.

SBOM generation and CVE matching

VEX Studio inventories your dependency tree and cross-references it against vulnerability databases, so every vulnerability found starts from a verifiable component list.

  • Scans package manifests and lockfiles automatically
  • Flags every CVE affecting a matched component
  • Keeps the SBOM as the audit trail for every downstream decision
Scan-results.log

$ vex-studio scan ./

Building SBOM ...................... done (142 components)

Matching against CVE feed .......... done

4 findings require exploitability review
CVE-2025-31122libparse-jsonPending
CVE-2025-08841http-routerPending
CVE-2024-55210yaml-litePending
CVE-2024-51877crypto-shimPending
Before / After

Reported by scanner

4 CVEs ·"affected" · no context

After VEX Studio review
1 affected 3 not_affected (component_not_present / vulnerable_code_not_in_execute_path)

You decide what "affected" actually means

A CVE in a dependency doesn’t always mean your package is at risk. VEX Studio tells the difference between a component just being present and its vulnerable code actually being reachable, and that difference reduces false alerts for everyone using your VEX statements.

  • No blind auto-suppression of findings
  • Every judgment is tied to a documented question
  • Maintainers can keep the authority on their own code
02 ASSESS

CWE Guided Exploitability Questions

VEX Studio asks targeted questions tied to the CWE category of the vulnerability, then maps your answers to a VEX status and justification code.

Is the vulnerable function in http-router ever called by your code?
Yes, on the request path
No
Unknown
Can untrusted input reach that function without sanitization?
Yes
No, input is validated upstream
Unknown
Does compensating control (WAF, sandbox, network policy) mitigate exploitation?
Yes
No
Not applicable
Mapped result status: not_affected
justification: vulnerable code cannot be controlled by adversary
03 PUBLISH

Auditable OpenVEX, ready for use

Every answer you give is recorded against the CVE it resolves. The output is a standard OpenVEX document that can be used in the tools your users already run.

One document for every consumer

Package registries, SCA tools, and security teams that already speak VEX can ingest this file as-is. No custom parsers, no re-explaining your reasoning in a ticket thread.

  • Standard OpenVEX schema, machine-readable
  • Status and justification codes traceable to the original question
  • Safe to publish alongside a release or advisory
< /> JSON
{ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://secpod.dev/vex/http-router-CVE-2025-08841", "author": "maintainer@http-router", "statements": [ { "vulnerability": { "name": "CVE-2025-08841" }, "products": [ { "@id": "pkg:npm/http-router@2.3.1" } ], "status": "not_affected", "justification": "vulnerable_code_cannot_be_controlled_by_adversary" } ] }

Each entry in the OpenVEX output file settles into one of three status codes once the questionnaire is answered.

Status: not_affected

The component is present, but this build can't be exploited through it.

Status: affected

The vulnerable code path is reachable so mark it for remediation.

Status: under_investigation

Exploitability isn't settled yet; the questionnaire is still open.

It’s Opensource.
It is for OSS maintainers who need it.

VEX Studio is free, open source, and built by SecPod for maintainers
doing exploitability prioritization with no security team behind them

View on GitHubTalk to VEX team