# Vulnerability Editor

Vulnerability-Lookup supports two editors for creating and modifying vulnerability records:

- **Vulniverse:** A modular and extensible vulnerability record editor. Its functionality can be customized through optional panels, actions, and features.
- **Vulnogram:** A web-based editor providing a form-based interface for creating and editing CVE records.

The editor is an optional module, off by default. Turn it on in `config/website.py`:

```python
WEB_MODULES = {
    # ...
    "vulnerability_editor": True,
}
```

The editor pages are:

- `/vuln/create`, for a new record;
- `/vuln/<id>/edit`, for an existing record.

The former `/user/submit` and `/user/edit/<id>` redirect there (301). The create page is
under `Advisories → New vulnerability advisory` in the main menu.

When it is off:

- The editor pages, and the former URLs, answer 404.
- The "New vulnerability advisory" menu entry and the Edit button of records are not shown.
- The API of the editor (`/api/vulniverse_templates`, `/api/vulniverse_record_quality`, `/api/patch2vuln`) is not registered.
- The CNA API (`/api/cna`) still works, so API clients can create and update records.

When it is on, `VULNERABILITY_EDITOR` in `config/website.py` selects the editor:

```python
VULNERABILITY_EDITOR = "vulniverse"  # the default, or "vulnogram"
```

An unknown value stops the website at start-up.

## Configure Vulniverse

[Vulniverse](https://github.com/vulnerability-lookup/vulniverse) can be embedded into Vulnerability-Lookup and uses the host application's existing services for loading and saving vulnerability records.

```{figure} /_static/img/vulniverse.png
:alt: Vulniverse Editor.
:target: /_static/img/vulniverse.png

Vulniverse Editor.
```

Vulniverse-specific settings are defined in `config/vulniverse.json`, located in the Vulnerability-Lookup `config/` directory. This configuration controls which optional panels, actions, and features are available in the embedded editor.

Depending on the enabled functionality and the services provided by Vulnerability-Lookup, Vulniverse can offer capabilities such as record quality assessments, CPE recommendations, and AI-assisted vulnerability record generation.

## Configure Patch2Vuln

[Patch2Vuln](https://github.com/gcve-eu/gcve-lab-patch2vuln) is an optional service that uses large language models (LLMs) to generate vulnerability record drafts from software patches.

Vulnerability-Lookup does not run Patch2Vuln: it forwards the jobs to an external Patch2Vuln HTTP service and relays the results. To show the Patch2Vuln panel in Vulniverse:

1. Run a Patch2Vuln service that Vulnerability-Lookup can reach.
2. Configure it in `config/patch2vuln.json`:

   ```json
   {
     "patch2vuln_enabled": true,
     "patch2vuln_url": "http://<host>:<port>",
     "patch2vuln_timeout": 300,
     "api_key": ""
   }
   ```

   - `patch2vuln_enabled`: registers `/api/patch2vuln`. The panel is only shown when it is `true`.
   - `patch2vuln_url`: the address of the service.
   - `patch2vuln_timeout`: in seconds, how long to wait for the result of a job.
   - `api_key`: the token the service expects, if any. The `PATCH2VULN_API_TOKEN` environment variable takes precedence, to keep the secret out of the file.
3. Enable the panel in `config/vulniverse.json`: `"patch2vuln": true` under `panels`.
4. Restart the website: the panel and the endpoint are set up at start-up.

The panel needs both `patch2vuln_enabled` and `panels.patch2vuln`. With `patch2vuln_enabled` on and the service unreachable, jobs fail with "Could not reach the Patch2Vuln service".

Once configured, users can submit patches for analysis directly in Vulniverse. The generated vulnerability information can be reviewed before being selectively applied to the current record.

## Use Vulnogram

Set both settings in `config/website.py`, then restart the website:

```python
WEB_MODULES = {
    # ...
    "vulnerability_editor": True,
}

VULNERABILITY_EDITOR = "vulnogram"
```

- Both are needed: with `vulnerability_editor` off, the editor routes answer 404 whatever `VULNERABILITY_EDITOR` says.
- `config/vulniverse.json` and `config/patch2vuln.json` are not used.
- The Vulniverse API (`/api/vulniverse_templates`, `/api/vulniverse_record_quality`, `/api/patch2vuln`) is not registered.