vulnsig

Render CVSS vulnerability vectors as expressive SVG glyphs. Each glyph encodes all base metrics visually with shape, color, rings, and texture, so vulnerabilities are recognizable at a glance.

Supports CVSS 4.0, 3.1, and 3.0.

Visit vulnsig.io to interactively explore CVSS glyph configurations and recent or well-known CVE vector glyphs.

Install

npm install vulnsig

Usage

import { renderGlyph } from 'vulnsig';

const svg = renderGlyph({ vector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H' });

// override the score (e.g. if you already have it)
const svg2 = renderGlyph({ vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H', score: 10.0 });

// control rendered size in pixels (default 120)
const svg3 = renderGlyph({ vector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N', size: 64 });

renderGlyph returns an SVG string ready to embed in HTML or write to a file.

Examples

CVSS 4.0

| Glyph | Name | Vector | Score | |:-----:|------|--------|------:| | | Log4Shell | AV:N AC:L AT:N PR:N UI:N VC:H VI:H VA:H SC:H SI:H SA:H | 10.0 | | | EternalBlue | AV:N AC:L AT:N PR:N UI:N VC:H VI:H VA:H SC:N SI:N SA:N | 9.3 | | | Heartbleed | AV:N AC:L AT:N PR:N UI:N VC:H VI:N VA:N SC:L SI:N SA:N | 8.7 | | | Spectre | AV:L AC:H AT:P PR:L UI:N VC:H VI:N VA:N SC:H SI:N SA:N | 5.6 | | | XSS Stored | AV:N AC:L AT:N PR:L UI:P VC:L VI:L VA:N SC:N SI:N SA:N | 5.1 | | | USB Drop | AV:P AC:L AT:N PR:N UI:N VC:H VI:H VA:H SC:N SI:N SA:N | 7.3 |

CVSS 3.x

| Glyph | Name | Vector | Score | |:-----:|------|--------|------:| | | Log4Shell | AV:N AC:L PR:N UI:N S:C C:H I:H A:H | 10.0 | | | XSS Reflected | AV:N AC:L PR:N UI:R S:C C:L I:L A:N | 6.1 |

Visual encoding

Each metric maps to a distinct visual channel:

| Metric | Channel | |--------|---------| | Score | Hue — yellow (low) → orange → dark red (high) | | AV | Star points — N=8, A=6, L=4, P=3 | | AC | Star pointiness — L=sharp, H=blunt | | AT | Ring segmentation — N=solid, P=cut pattern | | PR | Star outline — N=none, L=thin, H=thick | | UI | Perimeter — N=spikes, P=bumps, A=clean | | VC/VI/VA | Inner ring brightness per sector | | SC/SI/SA | Outer ring band (split when any > 0) |

Requirements

Node.js 18+

What Is New in VulnSig

1.3.0

Added rendering of Exploit Maturity.

Improved rendering of PR.

1.2.0

Improved glyph rendering over diverse backgrounds.

1.1.0

Extension to the public interface.