feat: add CVE rules

[NY1024]

Add vulnerability detection rules for two AI components that previously had fingerprints but no corresponding CVE rules:

• Jan CVE-2024-36857: Arbitrary file read via /v1/app/readFileSync (CVSS 7.5, HIGH)
• Jan CVE-2024-36858: Arbitrary file upload RCE via /v1/app/writeFileSync (CVSS 9.8, CRITICAL)
• LocalAI CVE-2024-3135: Cross-Site Request Forgery (CSRF) (CVSS 3.0, LOW)

All rules include both Chinese (data/vuln/) and English (data/vuln_en/) versions. CVSS scores and descriptions are sourced from NVD API. All YAML files pass yamlcheck validation.

[boy-hack]

Code Review: feat: add CVE rules (Jan + LocalAI)

✅ Strengths

• Rules cover both data/vuln/ (CN) and data/vuln_en/ (EN) — bilingual parity maintained
• CVSS scores and severity levels are accurate
• rule: version <= "..." fields are correctly formatted

⚠️ Conflict / Duplicate Warning

data/vuln/jan/CVE-2024-36858.yaml and data/vuln_en/jan/CVE-2024-36858.yaml are also being added by PR #462.

The same file is added by two different PRs with slightly different content:

• This PR (feat: add CVE rules #457): Summary "Jan 任意文件上传导致远程代码执行漏洞" — more detailed security advice (4 steps)
• PR Add CVE rules for Jan and Open WebUI components #462: Summary "Jan 存在任意文件上传漏洞，攻击者可通过..." — 3 steps

Whichever PR merges second will conflict. Please coordinate with @NY1024 to deduplicate — suggest keeping one canonical version before merge.

Minor Notes

• CVE-2024-36857 (arbitrary file read via readFileSync): looks correct, CVSS 7.5 HIGH ✅
• CVE-2024-3135 (LocalAI CSRF): CVSS 3.0 LOW — note LocalAI fingerprint must exist for this rule to trigger; confirmed present in data/fingerprints/localai.yaml ✅

🟡 Verdict

LGTM with the caveat: resolve the duplicate jan/CVE-2024-36858 conflict with PR #462 first.

[NY1024]

Thanks for the review! The duplicate Jan/CVE-2024-36858 conflict with PR #462 has been resolved:

• Jan files removed from PR Add CVE rules for Jan and Open WebUI components #462 — the canonical Jan rules now live exclusively in this PR (feat: add CVE rules #457)
• Version range fixed — updated from version <= "0.4.12" to version > "0" && version < "0.5.2" to cover all affected versions (0.4.13–0.5.1 were missing from the original range)
• GHSA reference added — included https://github.com/advisories/GHSA-qfjh-mvq6-c5p8

Other notes confirmed:

• CVE-2024-36857 (arbitrary file read, CVSS 7.5 HIGH): ✅ correct
• CVE-2024-3135 (LocalAI CSRF, CVSS 3.0 LOW): ✅ data/fingerprints/localai.yaml exists in upstream, rule will trigger correctly

Ready for merge.

[NY1024]

The Jan duplicate with PR #462 has been resolved. PR #462 removed its Jan files (commit 6e68c2f), so this PR is the single source for Jan CVE rules. Also fixed the version range for CVE-2024-36858 from version <= "0.4.12" to version > "0" && version < "0.5.2" (commit cc86077). No conflict remains. Ready for merge.

[NY1024]

Code Review: feat: add CVE rules (Jan + LocalAI)

✅ Strengths

• Rules cover both data/vuln/ (CN) and data/vuln_en/ (EN) — bilingual parity maintained
• CVSS scores and severity levels are accurate
• rule: version <= "..." fields are correctly formatted

⚠️ Conflict / Duplicate Warning

data/vuln/jan/CVE-2024-36858.yaml and data/vuln_en/jan/CVE-2024-36858.yaml are also being added by PR #462.

The same file is added by two different PRs with slightly different content:

• This PR (feat: add CVE rules #457): Summary "Jan 任意文件上传导致远程代码执行漏洞" — more detailed security advice (4 steps)
• PR Add CVE rules for Jan and Open WebUI components #462: Summary "Jan 存在任意文件上传漏洞，攻击者可通过..." — 3 steps

Whichever PR merges second will conflict. Please coordinate with @NY1024 to deduplicate — suggest keeping one canonical version before merge.

Minor Notes

• CVE-2024-36857 (arbitrary file read via readFileSync): looks correct, CVSS 7.5 HIGH ✅
• CVE-2024-3135 (LocalAI CSRF): CVSS 3.0 LOW — note LocalAI fingerprint must exist for this rule to trigger; confirmed present in data/fingerprints/localai.yaml ✅

🟡 Verdict

LGTM with the caveat: resolve the duplicate jan/CVE-2024-36858 conflict with PR #462 first.

The Jan duplicate with PR #462 has been resolved. PR #462 removed its Jan files (commit 6e68c2f), so this PR is the single source for Jan CVE rules. Also fixed the version range for CVE-2024-36858 from version <= "0.4.12" to version > "0" && version < "0.5.2" (commit cc86077). No conflict remains. Ready for merge.