cve-scanner

cve-scanner plugin

WASM custom_step plugin for CVE scanning and security patching, modeled on patch/vulnerability-management workflows (scan → prioritize → patch → report).

It shells out on the target host via the remote_exec host function, so the target needs the relevant tools installed (a scanner for scan, a package manager for patch). No extra capabilities beyond allow_remote_exec.

Actions

scan

Runs grype or trivy on the host and emits a normalized JSON report on stdout, ready for env_from / loop_from downstream.

plugin: {
	id:     "cve-scanner"
	action: "scan"
	config: {
		scanner:      "auto"   // auto | grype | trivy   (auto prefers grype)
		target:       "dir:/"  // dir:<path> | image:<ref>
		min_severity: "high"   // negligible | low | medium | high | critical
		only_fixed:   true     // drop CVEs with no fix available
	}
}

Output:

{
  "scanner": "grype",
  "target": "dir:/",
  "total": 3,
  "by_severity": {"critical": 1, "high": 2},
  "cves": [
    {"id": "CVE-2024-1234", "severity": "critical",
     "package": "openssl", "installed": "3.0.2", "fixed": "3.0.13"}
  ]
}

Consume it downstream:

env_from: [{step: "scan", extract: {CRITICAL: ".by_severity.critical // 0"}}]
// or fan out one patch per CVE:
loop_from: {step: "scan", extract: ".cves[].package"}

patch

Applies security upgrades. Detects apt, dnf/yum, apk, zypper. Without --execute it lists pending upgrades (dry-run) instead of applying.

plugin: {
	id:     "cve-scanner"
	action: "patch"
	config: {
		manager:       "auto"  // auto | apt | dnf | yum | apk | zypper
		security_only: true    // security updates only where supported
		// packages: ["openssl", "libc6"]  // pin to specific packages
	}
}

Returns changed, exit_code, stdout/stderr per host.

Build & install

GOOS=wasip1 GOARCH=wasm go build -buildmode=c-shared -o plugin.wasm .
mkdir -p ~/.config/honey/plugins/cve-scanner
cp plugin.yaml plugin.wasm ~/.config/honey/plugins/cve-scanner/

Enable plugins.enabled: true in the honey config. See examples/recipe/patch_campaign.cue for an end-to-end campaign (scan → gate → patch → AI report).

Notes

• scan success does not depend on finding count; gate criticality in the recipe (failed_when, exit-code, or an opa step).
• patch uses sudo -n when not root; ensure passwordless sudo or run as root.
• Scanner/manager output flows back over SSH (remote_exec), so it is not subject to the small host_exec output cap.