# brew-sploits

Scan Homebrew for vulnerabilities that already have known exploits.

`brew-sploits` reads the vulnerabilities that `brew vulns --json` reports for your installed formulae. For every real CVE identifier, it asks the fprox service whether public proof-of-concepts or exploitation activity exist. It prints one JSON report to stdout.

## Output

The report has four fields.

- `exploited` lists the CVEs with known exploits.
- `not_exploited` lists the CVEs with no known exploits.
- `non_cve` lists the vulnerability IDs that are not CVEs, such as `OSV-*`.
- `vulnerable_packages` lists the unique Homebrew formulae that the CVEs affect.

For a single CVE, the tool marks it as exploited when either proof-of-concepts exist or proof-of-exploited is true.

## Requirements

- Go 1.26 or later
- Homebrew, with `brew` on `PATH`
- A live internet connection

## Build

Run `just build`. Or build the binary directly:

```sh
go build -o brew-sploits ./cmd/brew-sploits
```

## Usage

Run the binary to scan and print the report. Use `--help` for the option list
and `--version` for the version.

```sh
./brew-sploits
./brew-sploits | jq '.exploited'
./brew-sploits --help
```

## Limitations

The tool skips any CVE that the lookup fails to resolve. It writes a warning to stderr for each skipped CVE. It never labels a skipped CVE as exploited or not exploited.