mlab-cve

migrated to https://github.com/mlab-sh/mlab-cli

A small, fast Rust CLI to search CVEs from vuln.mlab.sh right from your terminal.

   ┳┳┓┓ ┏┓┳┓   ┏┓┓ ┏┓
   ┃┃┃┃ ┣┫┣┫───┃ ┃┃ ┣
   ┛ ┗┗┛┛┗┻┛   ┗┛┗┛┗┛
    vuln.mlab.sh client

• 🔎 Full-text + faceted search (severity, date range, exact match)
• 🆕 Latest 40 published CVEs
• 📄 Detailed view: CVSS vector breakdown, EPSS, CISA KEV, CWE, affected products, references
• 🎨 Colored output (CRITICAL / HIGH / MEDIUM / LOW)
• 📦 --json flag for piping into jq, scripts, dashboards…
• 🦀 Single static binary, no runtime deps

---

Install

From a release

Grab a prebuilt binary from the Releases page for your platform:

Platform	Target triple
macOS (Apple Silicon)	aarch64-apple-darwin
Linux x86_64	x86_64-unknown-linux-gnu
Linux ARM64	aarch64-unknown-linux-gnu

Then:

tar -xzf mlab-cve-<version>-<target>.tar.gz
chmod +x mlab-cve
sudo mv mlab-cve /usr/local/bin/

From source

You need a recent stable Rust toolchain (≥ 1.74). Install via rustup.

git clone https://github.com/mlab-sh/mlab-cve.git
cd mlab-cve
cargo build --release
./target/release/mlab-cve --help

To install it on your PATH:

cargo install --path .

---

Local build (cheat sheet)

# debug build (fast compile)
cargo build

# release build (optimized, stripped)
cargo build --release

# run without installing
cargo run -- latest

# run with arguments
cargo run -- search openssl --severity high

# check / lint
cargo check
cargo clippy --all-targets -- -D warnings
cargo fmt

The release binary lives at target/release/mlab-cve.

---

Usage

mlab-cve <COMMAND> [OPTIONS]

Global flags:

Flag	Description
--json	Emit raw JSON instead of pretty output.
--no-banner	Don't print the ASCII banner.
-h, --help	Show help.
-V, --version	Show version.

Commands

latest — the 40 most recent CVEs

mlab-cve latest

search — keyword search

mlab-cve search openssl
mlab-cve search log4j --severity critical --limit 10
mlab-cve search "remote code execution" --from 2024-01-01 --to 2024-12-31
mlab-cve search CVE-2024-3094 --exact

Options:

Flag	Default	Description
-p, --page <N>	0	0-based page index
-l, --limit <N>	20	Results per page (max 100)
-s, --severity	—	critical / high / medium / low
--from <YYYY-MM-DD>	—	Lower bound on published date
--to <YYYY-MM-DD>	—	Upper bound on published date
-x, --exact	off	Exact match instead of fuzzy

show — full detail for a CVE

mlab-cve show CVE-2024-3094
mlab-cve --json show CVE-2024-3094 | jq '.cvss_score, .epss_score'

Piping JSON

mlab-cve --json search openssl --severity critical --limit 50 \
  | jq -r '.cves[] | [.id, .cvss_score, .epss_score] | @tsv'

---

Examples

Latest critical CVEs from the past week:

mlab-cve search "" --severity critical --from "$(date -v -7d +%F)"

Top exploited (CISA KEV) entries that touch Apache:

mlab-cve --json search apache --limit 100 \
  | jq '.cves[] | select(.in_kev) | .id'

---

API reference

This client talks to the public JSON API documented at https://vuln.mlab.sh. Endpoints used:

• GET /api/v1/cve — search
• GET /api/v1/cve/latest — latest 40
• GET /api/v1/cve/{ID} — detail

No auth, no API key. All endpoints are cached server-side.

---

Releases / CI

GitHub Actions builds and publishes binaries for:

• macOS ARM64 (aarch64-apple-darwin)
• Linux x86_64 (x86_64-unknown-linux-gnu)
• Linux ARM64 (aarch64-unknown-linux-gnu)

A release is produced automatically when a tag matching the version in Cargo.toml is pushed. To cut a release:

# bump version in Cargo.toml first, then:
VERSION=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
git tag "v$VERSION"
git push origin "v$VERSION"

The workflow can also be triggered manually from the Actions tab; it reads the version from Cargo.toml and creates v<version> if it doesn't exist.

---

License

MIT — see LICENSE.