VulnTrain

VulnTrain turns the vulnerability data collected by Vulnerability-Lookup into AI datasets and trained models. It processes over one million advisory records (CVE, GitHub advisories, CSAF, PySecDB, CNVD, FSTEC) to answer questions such as:

• How severe is this vulnerability, given only its description?
• Which CWE does this patch fix?
• Which MITRE ATT&CK techniques does this CVE enable?

All resulting datasets and models are published on Hugging Face:

Installation

pipx install VulnTrain

For development:

git clone https://github.com/vulnerability-lookup/VulnTrain.git
cd VulnTrain/
poetry install

Documentation

Full documentation — configuration, dataset generation, training recipes and methodology — is available at https://vulnerability-lookup.github.io/VulnTrain

For more information about the use of AI in Vulnerability-Lookup, please refer to the user manual.

Usage

Every task follows the same three stages, each with its own command.

1. Build a dataset from the vulnerability sources and push it to the Hub:

vulntrain-dataset-generation --sources cvelistv5,github,csaf_redhat,pysec \
  --repo-id CIRCL/vulnerability-scores

2. Train a model on that dataset (trainers push to the Hub by default; use --no-push for a local run):

vulntrain-train-severity-classification --base-model roberta-base \
  --dataset-id CIRCL/vulnerability-scores \
  --repo-id CIRCL/vulnerability-severity-classification-roberta-base

3. Validate the trained model:

vulntrain-validate-severity-classification

Available tasks

Every command accepts --help. The exact command lines used to regenerate each published artifact are in the runbook.

How to cite

For the severity classification work:

Bonhomme, C., & Dulaunoy, A. (2025). VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification (Version 1.4.0) [Computer software]. https://doi.org/10.48550/arXiv.2507.03607

@misc{bonhomme2025vlai,
    title={VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification},
    author={Cédric Bonhomme and Alexandre Dulaunoy},
    year={2025},
    eprint={2507.03607},
    archivePrefix={arXiv},
    primaryClass={cs.CR}
}

For the ATT&CK technique mapping work:

Bonhomme, C., & Dulaunoy, A. (2026). Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion. https://doi.org/10.48550/arXiv.2607.25572

@misc{bonhomme2026mappingcvesmitreattck,
    title={Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion},
    author={Cédric Bonhomme and Alexandre Dulaunoy},
    year={2026},
    eprint={2607.25572},
    archivePrefix={arXiv},
    primaryClass={cs.CR},
    url={https://arxiv.org/abs/2607.25572},
}

License

VulnTrain is licensed under GNU General Public License version 3

Copyright (c) 2025-2026 Computer Incident Response Center Luxembourg (CIRCL)
Copyright (C) 2025-2026 Cédric Bonhomme - https://github.com/cedricbonhomme
Copyright (C) 2025 Léa Ulusan - https://github.com/3LS3-1F

Funding

AIPITCH (AI-Powered Innovative Toolkit for Cybersecurity Hubs) is a co-funded EU project supported by the European Cybersecurity Competence Centre (ECCC) under the DIGITAL-ECCC-2024-DEPLOY-CYBER-06-ENABLINGTECH program and CIRCL.

The project brings together an international consortium to develop AI-based tools that enhance the capabilities of operational cybersecurity teams. These tools are designed to support critical services, with a focus on national security teams, while also being applicable to internal security teams in companies and institutions.