vulnlog report impact

Generates an impact report from one or more Vulnlog files. The report shows which vulnerabilities affect the project and which release ships each fix. Use it to decide whether a bugfix release is needed and what to update.

vulnlog report impact <file...> [filter flags] [-o <path>]

Multiple files are merged and must share the same project metadata. Use - as a file argument to read from stdin and -o - to write the report to stdout.

Flag Description

-o, --output <path>

Output file path, or - to write to stdout. Defaults to vulnlog-impact-report.html in the current directory.

--reporter <value>

Filter on reporter.

--as-of <release-id>

Report the state as of this release. Includes all releases up to and including that release. A fix only counts once it has shipped inside that range. A vulnerability whose resolution targets a later release is reported under its pre-resolution state: open for affected, accepted for affected with disposition: wont fix, and not applicable for not affected. The report therefore shows what is actually shipped at the chosen release.

--tag <text>

Filter on tags. Use multiple times to filter on multiple tags.

--state <state>

Filter on vulnerability state. One of under investigation, open, accepted, resolved, not applicable. Use multiple times to report several states together. Combined with --as-of, each entry is reported in the state it was in at that release, so --as-of 1.1.0 --state open shows what was still open when 1.1.0 shipped. Naming a state no entry is in is valid and produces an empty report.

--verdict <verdict>

Filter on triage verdict. One of under investigation, affected, not affected. Use multiple times to report several verdicts together. A verdict is what you recorded, so it does not change with --as-of. --verdict "under investigation" selects the same entries as --state "under investigation"; the other two each span several states, so --verdict affected covers open, accepted, and affected entries that are already resolved.

--disposition <disposition>

Filter on the remediation intent recorded for affected entries. One of will fix, wont fix. Use multiple times to report both. Affected entries that state no intent are not selected by either value.

-

Use as the file argument to read from stdin.

Report contents

The rendered HTML is a single, self-contained document. It contains the following sections:

  • Header: project organization, name, and author; the ISO-8601 UTC generation timestamp; the list of input file names (visible when several files are merged); and the applied filter (release, tags, reporter).

  • Summary: total entry count, breakdown by state, breakdown of open entries by severity, and breakdown of accepted entries by severity.

  • Entry table: four columns (IDs, State, Details, Releases) sorted by state (open first), then severity (critical to low), then primary ID. Each row carries a coloured left stripe: green for resolved, violet for accepted, grey for not applicable, severity-coloured for open entries, and uncoloured for entries under investigation. The Details cell shows the verdict, severity, and disposition (each where applicable), the VEX justification for not affected entries, and the entry’s description and analysis text. The verdict is omitted while an entry is still under investigation, because no verdict has been recorded yet.

  • Footer: Vulnlog version and a link to vulnlog.dev.

The report is fully offline (no network requests), CSP-locked, print-friendly, and adapts to the reader’s light or dark system theme.

Examples

Generate an HTML report
vulnlog report impact full-example.vl.yaml
Wrote: vulnlog-impact-report.html
Generate a merged report from multiple Vulnlog files
vulnlog report impact frontend.vl.yaml backend.vl.yaml
Wrote: vulnlog-impact-report.html
Show what a filter resolved to
vulnlog -v report impact vulnlog.yaml --as-of 1.1.0
verbose: as-of filter expanded to releases: 1.0.0, 1.1.0
Wrote: vulnlog-impact-report.html

To generate an HTML report using the Vulnlog Docker container:

docker run --rm -v "$PWD:/work" ghcr.io/vulnlog/vulnlog:0.17.0 report impact vulnlog.yaml --output report.html
Wrote: /work/report.html

This renders an example Vulnlog HTML report:

Example Vulnlog HTML Report
Figure 1. Example Vulnlog HTML Report

When the command fails

The command exits non-zero on bad input. It never fails because the report contains vulnerabilities.

  • Unknown --reporter, --as-of, or --tag: the command lists the known values and exits 5.

  • Input files with different project metadata: the command exits 2.

  • No subcommand, as in vulnlog report vulnlog.yaml: the command prints the available reports and exits 1.

See Exit codes and messages for the full table.

See also