Vulhub
A collection of ready-made vulnerable software environments you can start with Docker Compose.
- Stars
- 21.4k
- Forks
- 4.8k
- Licence
- MIT
- Language
- Dockerfile
- Last update
- 19 days ago
- Type
- Dev tool
What it is
Vulhub is a set of pre-built, deliberately vulnerable environments packaged as Docker Compose files. Each one is a known-vulnerable application you can start with a single command, which makes it easier to practice security testing without setting up the software by hand. It is intended for security research, learning, and demonstrations.
- Start a vulnerable environment such as langflow/CVE-2025-3248 with docker compose up -d
- Follow the reproduction steps in each environment's own README
- Shut down and remove an environment with docker compose down -v after testing
Great for
- Security students practicing reproducing known vulnerabilities
- Security researchers who need a quick, disposable vulnerable target
- Instructors preparing demonstrations of web vulnerabilities
- People already comfortable running Docker commands
Not ideal for
- Production systems: the README states the environments are for testing and education only
- Users without Docker who are not ready to install it, since every environment depends on it
- Machines with very limited resources: the README recommends at least 1GB RAM
How to get it
- 1
Clone and build from source
You'll need: Docker with the docker compose command
Download Vulhub
git clone --depth 1 https://github.com/vulhub/vulhubLaunch an example environment
cd vulhub/langflow/CVE-2025-3248 && docker compose up -dClean up after testing
docker compose down -v - 2
Run it
- Install Docker and make sure the service is running
- Clone the repository with git clone --depth 1
- Change into a vulnerability directory such as vulhub/langflow/CVE-2025-3248
- Run docker compose up -d, then read that environment's README for reproduction steps
- 3
Get the most out of it
- Read the README inside each environment directory for its specific reproduction steps
- Use the Troubleshooting section for Apple Silicon fixes like setting DOCKER_DEFAULT_PLATFORM
- Check the FAQ at vulhub.org for issues such as low ulimit settings on Kali Linux
- Run docker compose down -v after each session to remove containers and volumes
Downloads
Strengths
- Each environment launches with one command, per the README
- Uses the built-in docker compose command, so no separate docker-compose install is needed
- Ships with MIT licensing and a large community with Discord and X channels
Trade-offs
- Some environments may not run on ARM machines or on Kali Linux without fixes described in the Troubleshooting section
- Docker Hub access may be blocked in mainland China, requiring a mirror or overseas VPS
- Environments are intentionally vulnerable, so they must be run in isolated networks
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| vulhub (this) | 21.4k | Dev tool | beginner | 19 days ago | Security students practicing reproducing known vulnerabilities |
| colima | 31.5k | Dev tool | beginner | 23 days ago | Mac developers who want Docker containers without Docker Desktop |
| docker-elk | 18.4k | Dev tool | beginner | 4 days ago | Developers who want to try the Elastic stack on a single machine |
| laradock | 12.7k | Dev tool | intermediate | 6 days ago | PHP developers who want a consistent local environment across Linux, macOS and Windows |
| full-stack-fastapi-template | 46.1k | Framework | intermediate | 4 days ago | Developers starting a new full-stack web app with a Python backend and React frontend |
| dockge | 24.7k | App | beginner | 14 days ago | People who run Docker Compose stacks on a home server or small Linux machine |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.