alt Hacker NewsIt's going to be very very difficult to build this system as the exploitability of any particular CVE can massively vary depending on your system configuration.
There are a lot of things that are bugs, but cannot be exploited in a standard configuration, most people would wonder why this is even a CVE.
But then you have those users that would have the application, then something like a report module that was imported, and another 3rd party module that imports images, and maybe another one that arranges the images in a chart. And suddenly that isolated CVE is now exploitable by user written data because of the original bug, it just required a complex and unexpected chain to get there.
> There are a lot of things that are bugs, but cannot be exploited in a standard configuration
And this describes the vast majority of CVEs you see when you scan your dependencies. Typical case: Your regex library has a denial of service vulnerability for crafted regular expressions but your program never allows users to have any influence over the regex.