GitHub - alegrey91/vex8s: Suppress vulnerabilities applying Kubernetes context to scans · GitHub

Skip to content

Navigation MenuSign inAppearance settingsPlatformAI CODE CREATIONGitHub CopilotWrite better code with AIGitHub Copilot appDirect agents from issue to mergeMCP RegistryIntegrate external toolsDEVELOPER WORKFLOWSActionsAutomate any workflowCodespacesInstant dev environmentsIssuesPlan and track workCode ReviewManage code changesCode QualityEnforce quality at mergeAPPLICATION SECURITYGitHub Advanced SecurityFind and fix vulnerabilitiesCode securitySecure your code as you buildSecret protectionStop leaks before they startEXPLOREWhy GitHubDocumentationBlogChangelogMarketplaceView all featuresSolutionsBY COMPANY SIZEEnterprisesSmall and medium teamsStartupsNonprofitsBY USE CASEApp ModernizationDevSecOpsDevOpsCI/CDView all use casesBY INDUSTRYHealthcareFinancial servicesManufacturingGovernmentView all industriesView all solutionsResourcesEXPLORE BY TOPICAISoftware DevelopmentDevOpsSecurityView all topicsEXPLORE BY TYPECustomer storiesEvents & webinarsEbooks & reportsBusiness insightsGitHub SkillsSUPPORT & SERVICESDocumentationCustomer supportCommunity forumTrust centerPartnersView all resourcesOpen SourceCOMMUNITYGitHub SponsorsFund open source developersPROGRAMSSecurity LabMaintainer CommunityGitHub StarsArchive ProgramREPOSITORIESTopicsTrendingCollectionsEnterpriseENTERPRISE SOLUTIONSEnterprise platformAI-powered developer platformAVAILABLE ADD-ONSGitHub Advanced SecurityEnterprise-grade security featuresCopilot for BusinessEnterprise-grade AI featuresPremium SupportEnterprise-grade 24/7 supportPricingSearch/Sign inSign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

alegrey91

/

vex8s

Public

Notifications
You must be signed in to change notification settings

Fork
0

Star
24

Code

Issues
1

Pull requests
0

Actions

Projects

Security and quality
0

Insights

Additional navigation options

Code

Issues

Pull requests

Actions

Projects

Security and quality

Insights

mainBranchesTagsGo to fileCodeOpen more actions menuLatest commit History101 Commits101 CommitsFolders and filesNameNameLast commit messageLast commit date.github/workflows.github/workflows  .vscode.vscode  cmdcmd  docsdocs  examplesexamples  pkgpkg  testtest  .gitignore.gitignore  LICENSELICENSE  MakefileMakefile  README.mdREADME.md  go.modgo.mod  go.sumgo.sum  main.gomain.go  model-version.txtmodel-version.txt  vex8s-logic.pngvex8s-logic.png  vex8s.pngvex8s.png  View all filesRepository files navigationREADMELicenseMore itemsVex8s

(this logo is not AI generated)
Vex8s generates VEX documents by correlating container vulnerabilities with Kubernetes settings to determine which CVEs are actually exploitable in your cluster.
Please note, this is an experimental project. Things might change quickly.
How It Works
The project aims to assess the exploitability of known CVEs within Kubernetes workloads by combining vulnerability classification and securityContext analysis.

It is based on the following concept:

Each CVE is categorized into one or more vulnerability classes (CWE)
CVE description is processed by an embedded ML model to predict its exploitation category.
Both the CWEs and the predicted exploitation categories are combined to determine if the CVE is mitigable.
Each exploitation category, maps to a set of Kubernetes settings that can block or reduce the impact.
By parsing a Kubernetes manifest, we can inspect the container settings to evaluate whether the relevant settings are in place.
Combining both analyses allows the system to determine if a CVE is exploitable in a given workload configuration.
If it results in a CVE mitigation, we add this to the final VEX document.

For a more in-depth reading you can consult this paper: Environment-Aware Vulnerability Suppression Using Kubernetes Security Contexts and VEX
Installation
You can download the latest binary from the release page.
Or you can build it manually:
make build

Usage
vex8s currently supports 2 ways to generate VEX documents:

passive-mode: passing an already generated vulnerability report created by trivy or grype.

active-mode: actively scanning the images using trivy or grype engines and then gereating the document based on the results.

Passive mode (recommended)
Using trivy:
# generate vulnerability report.
trivy image --format json --output nginx.trivy.json nginx:1.21.0

# generate VEX document by processing vulnerability report.
vex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json --output nginx.vex.json

# scan again with VEX document to suppress vulnerabilities.
trivy image --vex nginx.vex.json --show-suppressed nginx:1.21.0

The same can be applied using grype:
# generate sbom report.
grype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0

# generate vulnerability report.
grype sbom:./nginx.grype.json --output json --file nginx.grype-vr.json

# generate VEX document by processing vulnerability report.
vex8s generate --manifest examples/nginx.yaml --report nginx.grype-vr.json --output nginx.vex.json

# scan sbom with VEX document to suppress vulnerabilities.
grype sbom:./nginx.grype.json --output table --vex nginx.vex.json --show-suppressed

Active mode
Using trivy:
# scan the image and automatically generate VEX document.
vex8s generate --manifest examples/nginx.yaml --scan.engine trivy --output nginx.vex.json

# scan again with VEX document to suppress vulnerabilities.
trivy image --vex nginx.vex.json --show-suppressed nginx:1.21.0

The same can be applied using grype:
# generate sbom report.
grype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0

# scan the image and automatically generate VEX document.
vex8s generate --manifest examples/nginx.yaml --scan.engine grype --output nginx.vex.json

# scan sbom with VEX document to suppress vulnerabilities.
grype sbom:./nginx.grype.json --output table --vex nginx.vex.json --show-suppressed

Classifiers
Each CVE is classified into one or more exploitation classes, which drive the
mitigation decision. vex8s supports two classifier engines via --classifier:

embedded (default): an offline ONNX ML model
bundled in the binary. No network access required.
gemini: uses Google's Gemini LLM to classify the CVE description.
Requires the GEMINI_API_KEY environment variable (optionally GEMINI_MODEL).

export GEMINI_API_KEY="your-api-key"

vex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json \
--output nginx.vex.json --classifier gemini

See the documentation — in particular the
User Guide — for a full walkthrough, the Gemini
classifier setup, and a complete flag reference.
References
This project was inspired by Akihiro Suda's project vexllm.
AboutSuppress vulnerabilities applying Kubernetes context to scansTopicscvecwegrypemachine-learningsecuritysecurity-scannersecurity-toolssupply-chaintrivyvexvulnerabilityResourcesReadmeLicenseActivityStars24 starsWatchers0 watchingForks0 forksReport repositoryReleasesPackagesContributorsLanguages

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms

Privacy

Security

Status

Community

Docs

Contact

Manage cookies

Do not share my personal information

You can’t perform that action at this time.

The vex8s project is designed to assess the exploitability of known common vulnerabilities and exposures (CVEs) within Kubernetes workloads by correlating container vulnerability data with specific Kubernetes security context settings. The core concept involves a multi-stage analytical process to determine if a vulnerability is actually exploitable within a deployed environment. This process begins by classifying each CVE into one or more vulnerability classes, known as CWEs, and then employing an embedded machine learning model to predict the exploitation category of the CVE based on its description. These vulnerability classifications and ML predictions are then combined to determine potential mitigation strategies.

The system links these derived exploitation categories to specific Kubernetes settings that possess the capability to block or reduce the impact of the vulnerability. By parsing the Kubernetes manifest of the workload, vex8s inspects the container settings to verify the presence and configuration of these relevant security settings. The integration of these two analytical streams—the vulnerability classification/prediction and the Kubernetes context inspection—allows the system to definitively determine if a specific CVE is exploitable given the current workload configuration. If the analysis indicates that a mitigation strategy is possible, this finding is incorporated into the final VEX document generated by the system.

The methodology is inspired by the work of Akihiro Suda, particularly vexllm, and is formally documented in research concerning environment-aware vulnerability suppression using Kubernetes security contexts and VEX. The project provides users with flexible modes for operation, primarily passive-mode and active-mode, depending on the presence of pre-existing vulnerability reports. In passive mode, the system processes vulnerability reports generated by tools like trivy or grype, in conjunction with Kubernetes manifests, to generate a VEX document. A subsequent scanning operation can then use this VEX document to suppress the reported vulnerabilities in the container images. Active mode allows the system to perform the scanning of images directly using engines like trivy or grype and automatically generate the corresponding VEX document.

The system incorporates flexible classification mechanisms that allow for different approaches to determining the exploitation categories. It natively supports an embedded classification engine, which utilizes an offline ONNX machine learning model bundled within the binary, requiring no external network access. Additionally, vex8s supports integration with large language models, such as Gemini, for classifying CVE descriptions. This LLM-based classification, when enabled, requires the user to provide an appropriate API key, allowing for more sophisticated categorization of vulnerabilities. This adaptability in classification, combined with the context-aware analysis of Kubernetes settings, positions vex8s as a tool for advanced application security posture management within containerized environments.