cwe-cve-enumerator

A zero-dependency command-line application for viewing CWE entries and enumerating CWE and NVD CVE records. It uses the CWE REST API and the NVD CVE API.

Install

npm install --global cwe-cve-enumerator

Node.js 18 or later is required because this package uses the built-in Fetch API.

Configuration

The CWE REST API is public and does not require a key. For improved NVD rate limits, set NVD_API_KEY in the environment:

export NVD_API_KEY="your-nvd-api-key"

PowerShell:

$env:NVD_API_KEY = "your-nvd-api-key"

Commands

cwe-cve cwe get 79
cwe-cve cwe get 79 89
cwe-cve cve get CVE-2024-3094

Record commands print concise JSON summaries. CWE output contains its ID, name, description, likelihood of exploit, and mitigation descriptions. CVE output contains its ID, English description, lifecycle dates, status, best available CVSS severity, and mapped CWEs. cwe get uses CWE's detailed weakness/{id} endpoint; a missing CVE exits nonzero.

Enumeration

cwe-cve cwe list --view 1000
cwe-cve cve list --cwe CWE-79 --kev --limit 50
cwe-cve cve list --keyword "SQL injection" --page-size 200 > cves.jsonl

cwe list prints one unique CWE ID per line. It reads a view's top-level members then traverses the documented descendants?view= endpoint. cve list streams one JSON CVE record per line (JSON Lines) using NVD's required startIndex / resultsPerPage pagination. NVD permits up to 2,000 results per page.

Run cwe-cve --help for all options. CVE list supports --cwe, --keyword, --kev, --published-after, --published-before, --page-size, and --limit.

Errors

Failed API requests exit nonzero and print the HTTP status and response body to standard error.

Publishing

Before publishing, replace the repository URLs and, if necessary, the package name in package.json with the npm name you own. Then run:

npm install
npm publish