CVE Analysis Through REFLEX

Real-world vulnerabilities, analysed through the developer security lens.

Why Analyse CVEs with REFLEX?

Most CVE descriptions focus on technical details and CVSS scores. For developers, the real questions are different:

• How would I recognise this in my own code?
• What practices would have prevented it?
• How do I find out if I'm affected?
• What should I do right now?

REFLEX turns a CVE bulletin into answers you can act on.

How It Works

Each CVE analysis follows the six REFLEX stages.

Reconnaissance

Understand how attackers think. How attackers find systems exposed to this vulnerability, and what gives those systems away.

Evaluate

Apply attacker knowledge to assess your own vulnerabilities. What makes the bug exploitable, and how to check whether your systems meet those conditions.

Fortify

Build defences and secure defaults. The fix, the temporary mitigations that work, and the coding patterns that prevent this class of bug.

Limit

Reduce blast radius when things go wrong. The architecture and runtime controls that contain the damage if exploitation succeeds.

Expose

Make attacks visible through monitoring and detection. The log patterns, network signals and process behaviour that reveal an attempt or a compromise.

Exercise

Practise response until it becomes muscle memory. Safe ways to test your defences and rehearse your response to this vulnerability.

Featured CVE Analyses

Java

• CVE-2021-44228: Log4Shell

  • Impact: Remote code execution through JNDI lookups in Apache Log4j 2
  • CVSS: 10.0 Critical
  • Key lesson: Dependency management is security management. A library you never chose can still put code execution in your request path.
  • REFLEX focus: Finding hidden and shaded copies, the one temporary mitigation that worked, egress controls

• CVE-2026-22738: Spring AI SpEL Injection in SimpleVectorStore

  • Impact: Remote code execution through SpEL injection in Spring AI filter expression keys
  • CVSS: 9.8 Critical
  • Key lesson: AI frameworks inherit the old bug classes. SpEL injection in a vector store is expression-language injection, the same class of bug as SQL injection.
  • REFLEX focus: Server-built filters with allowlisted keys, validating LLM-generated filters, egress through an allowlisting proxy

JavaScript

• CVE-2026-1245: binary-parser Code Injection
  • Impact: Code injection in the binary-parser npm package through field names and encodings
  • CVSS: 6.5 Medium
  • Key lesson: Libraries that generate code turn data into code. Untrusted input must never reach them unvalidated.
  • REFLEX focus: Finding dynamic parser definitions, validating names and encodings, isolating parser compilation

Write Your Own Analysis

Want to analyse another CVE the same way? The CVE analysis template in the site's GitHub repository sets out the structure these pages follow. It covers:

• The facts to verify before writing, such as exact version ranges and the safe upgrade target
• The questions to answer at each REFLEX stage
• The page layout, from the overview block to the references

Use it to brief your team on a new vulnerability, or to propose an analysis for this site.