VulnTrace — Orbit Vulnerability Blast Radius Tracer

• 

  VulnTrace: 20 callers traced via Orbit + CVE-2023-32681 intelligence from NVD API

• 

  Orbit gl_edge traversal mapping all callers of send() in requests library

The Problem

When SAST flags a vulnerability, developers face hours of manual work:

• Which functions call this vulnerable code?
• What is the real CVE severity?
• Which production modules will ship this risk?

In large codebases, blast radius analysis is skipped entirely — teams fly blind.

The Solution

VulnTrace combines two data sources no other tool unifies in one CLI:

1. GitLab Orbit knowledge graph — traverses gl_definition and gl_edge tables to map every caller and dependent automatically
2. NVD CVE Intelligence Layer — pulls real CVSS v3.1 score, attack vector, and privileges required from NIST NVD API

Result: blast radius + CVE severity in one command. Patch prioritization in seconds, not hours.

How I Built It

• Queried Orbit Local DuckDB graph via glab orbit local sql
• Integrated NVD API v2 — no API key required, real-time CVE data
• Combined blast radius severity (HIGH/MEDIUM/LOW) with CVSS score into a risk matrix
• Published as a GitLab Duo Agent Skill on the AI Catalog

Demo

python vulntrace.py --function send --file requests/api.py --cve CVE-2023-32681

Output: 20 callers found, 3 core production modules at risk, CVE CVSS 6.1 NETWORK vector — all in under 3 seconds.

What's Next

• Production vs test caller filtering
• Orbit Remote support for CI/CD pipeline integration
  
• GitLab Issue auto-creation with blast radius report
• EPSS exploit probability scoring

Challenges

Orbit Local query parsing required custom table output parsing. NVD API rate limiting (5 req/30sec) handled gracefully with timeout fallback.

Built With

• agent
• duckdb
• duo
• gitlab
• gitlab-orbit
• glab-cli
• nvd-api
• python