x-cmd/x-cmd v0.9.14 on GitHub

👉 View Full Changelog on X-CMD Website
👉 Version compare: v0.9.13...v0.9.14

✅ Upgrade Guide

x upgrade

📃 Changelog

cve

A coworker drops a CVE ID and asks: "Is this thing actually being exploited in the wild?"

Ten seconds ago you'd open five tabs — cve.org for the description, cvelistV5 for affected products, NVD for CVSS, EPSS for exploitation probability, CISA KEV for in-the-wild confirmation. Now it's one x cve:

x cve — TTY → fzf picker / pipe → TSV, newest first
x cve info CVE-2024-3094 — quick fields by id (cvss / description / year); batched and parallel across years via HTTP/2 multiplex
x cve detail CVE-2024-3094 — full cvelistV5 record (affected products, CWE, references, ADP, metrics, timeline)
x cve year 2024 — browse by year; --score 9 / --grep chromium to filter
x shodan CVE-2024-3094 — straight to the deeper stuff: EPSS, KEV listing, exploit writeups, vendor advisories (the upstream CVE record doesn't carry these). Crucially no Shodan API key needed — it hits cvedb.shodan.io's public endpoint, so you skip the token gate that x shodan search requires

Data pulls from daily xz-compressed TSVs at x-cmd/cve, cached locally — 1-day TTL for the current year, 180 days for older ones (they barely change). Cache hits from the second call. No API key, no sudo, no daemons.

# A coworker drops a CVE on you
x cve info CVE-2024-3094

# Want the full upstream record
x cve detail CVE-2024-3094

# Is this thing actually being exploited? (no Shodan token needed)
x shodan CVE-2024-3094

# What's landed lately
x cve

x cve la / ls — both "fast" and "doesn't feel stuck" got attention this round.
Streams years in reverse, stores rows newest-first on disk, no tac at read time; walks the filesystem directly, no index.tsv round-trip
Older-year TTL bumped 30 → 180 days; older data barely changes, fewer round-trips, less waiting
Synchronous refresh with a log line per download — cache misses no longer feel like a hang; you see what's happening next
stalled github.com timeout tightened 5s → 2s, falls back to the mirror faster
Missing years auto-fill from the manifest; no flags, no special case
fz picker: id column colored by score bucket (was only the score column), preview pane fixed to 9 columns (was 6, showed score as desc), CRITICAL→magenta / MEDIUM→cyan / unrated only gets red — the sea of red is gone

x cve
x cve ls

cwe

Got the CVE but still want to know which weakness class it falls under? MITRE's CWE catalog has 969+ entries — flipping through pages is slow.

x cwe pulls the MITRE catalog directly (2000.csv.zip, ~640 KB), caches locally, parses in pure POSIX awk — zero dependencies. The commands you'll actually use:

x cwe info CWE-79 — full record by id (description, related weaknesses, mitigations, consequences, observed examples), batched
x cwe / x cwe ls — TTY → fzf / pipe → TSV
x cwe fz — interactive picker
x cwe update — force-refresh (30-day TTL by default)

For offline use, set X_CMD_CWE_OFFLINE=1 to stay on cache only. Behind a proxy, HTTP_PROXY / HTTPS_PROXY are honored transparently through ___x_cmd curl.

# What does XSS as a class actually say?
x cwe info CWE-79

# Shorthand
x cwe CWE-89

# Browse / pick
x cwe
x cwe fz

# Force refresh
x cwe update

x cwe info output is sturdier and x cwe fz preview is cleaner.
Renderer rewritten end-to-end: info render + fz preview collapse into a single awk pass
YAML emission now uses block scalars, so fields with colons / quotes / commas parse correctly
Plain / double-quoted scalars supported; keys are colored so you can scan field names at a glance
x cwe recent removed (MITRE's CSV has no lastModified column — keeping it was misleading)

x cwe info CWE-79
x cwe fz


### [coin](https://x-cmd.com/mod/coin)

  - Fixed `x coin` exiting with `I|tui: The CSV table is empty` because the upstream API died.

The old source, `https://api.coincap.io/v2/assets`, is gone at the DNS level — not just unreachable from China, `curl` reports `Could not resolve host` from Europe and US vantage points too. Result: empty CSV piped into the TUI, TUI bails out immediately.

Now points at `https://api.coinpaprika.com/v1/tickers?limit=100` — top 100 by market cap, free, no registration, no API key, served via Cloudflare so it's reachable from more places than the old source. CoinPaprika returns a top-level array, so the `jo .data` step is dropped; field mapping is realigned: `priceUsd` → `quotes.USD.price`, `marketCapUsd` → `quotes.USD.market_cap`, `supply` → `total_supply`, `volumeUsd24Hr` → `quotes.USD.volume_24h`, `changePercent24Hr` → `quotes.USD.percent_change_24h`.

CoinPaprika's keyless tier doesn't expose VWAP, so the TUI table's `VWAP(24Hr)` column becomes `Change(7d)` (`quotes.USD.percent_change_7d`, which returns real values on the keyless tier). Still 7 columns, still 100 rows.

```bash
x coin
x coin --csv
x coin --raw

Thanks @donbagger for the suggestion and the reproducible test report!