Implementation of Modeling Local Exploit Hazard - A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency

adulau · August 5, 2026, 7:42am

Based on the following paper:

A proposal implementation in

github.com/vulnerability-lookup/vulnerability-lookup

Add local exploit hazard API (#530)

main ← codex/add-user-specific-feature-in-vulnerability-lookup

opened 06:47AM - 05 Aug 26 UTC

adulau

+631 -0

### Motivation - Implement the deterministic components of the local exploit ha…zard model from the referenced paper so instance-specific risk can be computed from an ELM probability (e.g., EPSS) and per-user inputs. - Allow users to supply control effectiveness, KEV policy parameters, and age/model settings so the model can be applied to specific vulnerability instances. ### Description - Add `vulnerabilitylookup/local_exploit_hazard.py` implementing `compute_local_exploit_hazard()`, support functions (`control_adjusted_likelihood`, `exponential_daily_hazard`, `weibull_*`), CVSS attack-vector extraction, ISO date parsing, and a `LocalExploitHazard` dataclass; default Weibull shape is `0.605`. - Expose a new REST endpoint `POST /api/exploit-hazard` via `website/web/api/v1/exploit_hazard.py` which validates input JSON (requires `epss`) and returns `adjusted_likelihood`, `daily_hazard`, `horizon_probability`, `model` and related metadata. - Register the new namespace in `website/web/api/v1/__init__.py` and add a usage example and description to `docs/api.md`. - Add tests in `tests/test_local_exploit_hazard.py` covering CVSS attack-vector parsing, control/KEV composition, exponential conversion, Weibull age-aware behavior, and the API endpoint. ### Testing - Ran the module sanity check with `python -m py_compile vulnerabilitylookup/local_exploit_hazard.py website/web/api/v1/exploit_hazard.py` and it succeeded. - Ran unit tests with `VULNERABILITYLOOKUP_HOME=/workspace/vulnerability-lookup PYTHONPATH=. poetry run pytest tests/test_local_exploit_hazard.py` and all tests passed (`5 passed`). - Ran static checks with `poetry run ruff check vulnerabilitylookup/local_exploit_hazard.py website/web/api/v1/exploit_hazard.py tests/test_local_exploit_hazard.py` and the linter returned no errors. ------ [Codex Task](https://chatgpt.com/codex/cloud/tasks/task_b_6a72b8c792a0832585211fedd6bee066)