Vulnerability Open Knowledge (VOK)

Vulnerability Open Knowledge (VOK) is a database containing information to reproduce a vulnerability (CVE) in a Debian Docker environment. It is an initiative to promote vulnerability research and education by reproducing Debian package CVEs in a controlled environment. Learn more about VOK's intention in our research article "On the Long-Term Reproducibility of Vulnerable Environments" (accepted publication at ISC, DOI to come).

Use VOK

In each CVE folder, metadata.yaml describes the CVE and details the vulnerable package, while the docker folder contains one or several Dockerfiles enabling vulnerable environment setups. When the field "reproduction_status" of the metadata.yaml file is set to "Yes", then the corresponding Dockerfile has been verified vulnerable against a functional exploit or any other way to trigger the vulnerability and observe its reported effect.

⚠️ Ethical note: This repository documents publicly disclosed CVEs only and, where available, publicly documented exploit references for research and educational purposes. Do not use this material against systems.

For most containers, the following commands respectively builds and executes the vulnerable environment:

~$ docker build cves/CVE-20XX-XXXX/docker -t "cve-20XX-XXXX"
~$ docker run -it cve-20XX-XXXX /bin/bash

or for services within the docker folder of a CVE:

~$ docker compose build
~$ docker compose up

🤝 Contributing

This is a controlled repository. Contributions are welcome with written approval only. Please refer to CONTRIBUTING.md.

🔒 Security

Please refer to SECURITY.md.

---

⚖️ Copyright and license

Copyright (c) 2021-2026 Orange SA

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

---

Contact

• Nicolas Dejon