vulnsig

Render CVSS vulnerability vectors as expressive SVG glyphs. Each glyph encodes all base metrics visually with shape, color, rings, and texture, so vulnerabilities are recognizable at a glance.

Supports CVSS 4.0, 3.1, 3.0, and 2.0.

Visit vulnsig.io to interactively explore CVSS glyph configurations and recent or well-known CVE vector glyphs.

Install

npm install vulnsig

Usage

import { renderGlyph } from 'vulnsig';

const svg = renderGlyph({ vector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H' });

// override the score (e.g. if you already have it)
const svg2 = renderGlyph({ vector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H', score: 10.0 });

// control rendered size in pixels (default 120)
const svg3 = renderGlyph({ vector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N', size: 64 });

renderGlyph returns an SVG string ready to embed in HTML or write to a file.

Examples

CVSS 4.0

Glyph	Name	Vector	Score
	Log4Shell	AV:N AC:L AT:N PR:N UI:N VC:H VI:H VA:H SC:H SI:H SA:H	10.0
	EternalBlue	AV:N AC:L AT:N PR:N UI:N VC:H VI:H VA:H SC:N SI:N SA:N	9.3
	Heartbleed	AV:N AC:L AT:N PR:N UI:N VC:H VI:N VA:N SC:L SI:N SA:N	8.7
	Spectre	AV:L AC:H AT:P PR:L UI:N VC:H VI:N VA:N SC:H SI:N SA:N	5.6
	XSS Stored	AV:N AC:L AT:N PR:L UI:P VC:L VI:L VA:N SC:N SI:N SA:N	5.1
	USB Drop	AV:P AC:L AT:N PR:N UI:N VC:H VI:H VA:H SC:N SI:N SA:N	7.3

CVSS 3.x

Glyph	Name	Vector	Score
	Log4Shell	AV:N AC:L PR:N UI:N S:C C:H I:H A:H	10.0
	XSS Reflected	AV:N AC:L PR:N UI:R S:C C:L I:L A:N	6.1

CVSS 2.0

CVSS 2.0 vectors are accepted both bare and prefixed (CVSS:2.0/...).

Name	Vector	Score
Heartbleed	AV:N/AC:L/Au:N/C:P/I:N/A:N	5.0
Conficker	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0
Auth-required	AV:N/AC:L/Au:S/C:P/I:P/A:P	6.5

Visual encoding

Each metric maps to a distinct visual channel:

Metric	Channel
Score	Hue — yellow (low) → orange → dark red (high)
AV	Star points — N=8, A=6, L=4, P=3
AC	Star pointiness — L=sharp, M=medium, H=blunt
AT	Ring segmentation — N=solid, P=cut pattern (CVSS 4.0)
PR / Au	Star outline — PR: N=none, L=thin, H=thick · Au (CVSS 2.0): N=none, S=thin, M=thick
UI	Perimeter — N=spikes, P=bumps, A=clean (CVSS 3.x/4.0)
VC/VI/VA · C/I/A	Inner ring brightness per sector (v2 N/P/C and v3 N/L/H share the channel)
SC/SI/SA	Outer ring band (split when any > 0; CVSS 3.x/4.0 only)
E	Center marker — 4.0: A=rings, P=disc · 2.0: H=rings, POC/F=disc

Requirements

Node.js 18+

What Is New in VulnSig

2.0.0

Added support for CVSS 2.0.

1.3.0

Added rendering of Exploit Maturity.

Improved rendering of PR.

1.2.0

Improved glyph rendering over diverse backgrounds.

1.1.0

Extension to the public interface.