Tito0015/cpg-nuclei-compiler

Deterministic Joern CPG-to-Nuclei YAML compiler & Docker verification harness

stars

commits

Rust

primary language

Sep 11, 2026

updated

medium.com/@mhiritarek/cpg-compilation-vs-llm-ai-generation-empirical-analysis-of-cve-2025-62593-rule-accuracy-6ea0b27583da

appsec

cpg

joern

nuclei

nuclei-templates

projectdiscovery

rust

sast

security-tools

static-analysis

vulnerability-scanner

README

CPG → Nuclei Closed Loop

Open-source Code Property Graph (CPG) compiler and ProjectDiscovery Nuclei exporter with a Docker verification harness.

Source (C/C++, Java, Go, Python, …) → Joern CPG → DataFlowSlice → Nuclei YAML → nuclei (Docker) → TP/TN report

What's included

Component	Path
Joern CPG bridge	`cpg_nuclei_core/src/joern_cpg_bridge.rs`
CPG schema / deserializer	`cpg_nuclei_core/src/cpg_schema.rs`, `cpg_deserializer.rs`
DFG / taint analysis	`cpg_nuclei_core/src/cross_tx_dfg.rs`, `parser.rs`, `taint.rs`
Nuclei YAML exporter	`cpg_nuclei_core/src/exporters/nuclei_exporter.rs`
Pipeline CLI	`cpg_nuclei_core/examples/run_cpg_pipeline.rs`
Docker closed-loop runner	`harness/docker_runner.py`
Architecture docs	`docs/cpg/`, `docs/nuclei/`

Quick start

Prerequisites

Install Joern and point JOERN_HOME at your distribution. See docs/cpg/JOERN_CLI_PROVISIONING.md.

Supported ingestion paths: C/C++, Java, Go, Python, and other Joern frontends.

Usage

# Rust compiler tests
cargo test -p cpg_nuclei_core

# Python integration (compiler + harness)
pytest tests/test_cpg_nuclei_compiler.py

# Export Nuclei YAML from source via Joern
cargo run --example run_cpg_pipeline -- --target path/to/main.c

# Closed-loop Nuclei scan (Docker required)
python -m harness.docker_runner --template templates/CVE-2024-51483.yaml --target http://127.0.0.1:5000

Non-destructive Nuclei SOP

Some community templates (including CVE-2024-51483) mutate application settings during execution. Against a live Changedetection.io instance:

Snapshot /settings (GET) before scanning.
Run Nuclei in an isolated environment.
Restore settings from the snapshot after the scan.

The local fixture server on :5000 is a non-production stub for harness tests only.

License

MIT — see LICENSE. The vendored Nuclei template under templates/ is from projectdiscovery/nuclei-templates (MIT).

Contributors

Tito0015

2 commits

See what people are saying

Hacker News (1)

Show HN: Rust compiler converting CPGs to Nuclei YAML

1 points · Sep 2, 2026

Similar repos

ajinabraham/njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js…

454

shared topics

bearer/bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

2,743

shared topics

securego/gosec

Go security checker

8,945

shared topics

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

11,002

shared topics

returntocorp/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like…

16,589

shared topics

projectdiscovery/nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

12,952

shared topics

analysis-tools-dev/static-analysis

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config…

14,766

shared topics

Agent-Field/sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and…

197

shared topics

Languages

Rust

94.0%

Python

5.9%

Tito0015/cpg-nuclei-compiler

Deterministic Joern CPG-to-Nuclei YAML compiler & Docker verification harness

stars

commits

Rust

primary language

Sep 11, 2026

updated

medium.com/@mhiritarek/cpg-compilation-vs-llm-ai-generation-empirical-analysis-of-cve-2025-62593-rule-accuracy-6ea0b27583da

appsec

cpg

joern

nuclei

nuclei-templates

projectdiscovery

rust

sast

security-tools

static-analysis

vulnerability-scanner

README

CPG → Nuclei Closed Loop

Open-source Code Property Graph (CPG) compiler and ProjectDiscovery Nuclei exporter with a Docker verification harness.

Source (C/C++, Java, Go, Python, …) → Joern CPG → DataFlowSlice → Nuclei YAML → nuclei (Docker) → TP/TN report

What's included

Component	Path
Joern CPG bridge	`cpg_nuclei_core/src/joern_cpg_bridge.rs`
CPG schema / deserializer	`cpg_nuclei_core/src/cpg_schema.rs`, `cpg_deserializer.rs`
DFG / taint analysis	`cpg_nuclei_core/src/cross_tx_dfg.rs`, `parser.rs`, `taint.rs`
Nuclei YAML exporter	`cpg_nuclei_core/src/exporters/nuclei_exporter.rs`
Pipeline CLI	`cpg_nuclei_core/examples/run_cpg_pipeline.rs`
Docker closed-loop runner	`harness/docker_runner.py`
Architecture docs	`docs/cpg/`, `docs/nuclei/`

Quick start

Prerequisites

Install Joern and point JOERN_HOME at your distribution. See docs/cpg/JOERN_CLI_PROVISIONING.md.

Supported ingestion paths: C/C++, Java, Go, Python, and other Joern frontends.

Usage

# Rust compiler tests
cargo test -p cpg_nuclei_core

# Python integration (compiler + harness)
pytest tests/test_cpg_nuclei_compiler.py

# Export Nuclei YAML from source via Joern
cargo run --example run_cpg_pipeline -- --target path/to/main.c

# Closed-loop Nuclei scan (Docker required)
python -m harness.docker_runner --template templates/CVE-2024-51483.yaml --target http://127.0.0.1:5000

Non-destructive Nuclei SOP

Some community templates (including CVE-2024-51483) mutate application settings during execution. Against a live Changedetection.io instance:

Snapshot /settings (GET) before scanning.
Run Nuclei in an isolated environment.
Restore settings from the snapshot after the scan.

The local fixture server on :5000 is a non-production stub for harness tests only.

License

MIT — see LICENSE. The vendored Nuclei template under templates/ is from projectdiscovery/nuclei-templates (MIT).

See what people are saying

Hacker News (1)

Show HN: Rust compiler converting CPGs to Nuclei YAML

1 points · Sep 2, 2026

Similar repos

ajinabraham/njsscan

njsscan is a semantic aware SAST tool that can find insecure code patterns in your Node.js…

454

shared topics

bearer/bearer

Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.

2,743

shared topics

securego/gosec

Go security checker

8,945

shared topics

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

11,002

shared topics

returntocorp/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like…

16,589

shared topics

projectdiscovery/nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

12,952

shared topics

analysis-tools-dev/static-analysis

⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config…

14,766

shared topics

Agent-Field/sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and…

197

shared topics

Contributors

Tito0015

2 commits

Languages

Rust

94.0%

Python

5.9%