Joern is a code analysis platform that generates code property graphs to enable vulnerability discovery and static program analysis across multiple languages including C, C++, Java, JavaScript, Python, Kotlin, and binary executables.
The tool addresses the challenge of analyzing code across different languages and formats by converting source code, bytecode, and binaries into a unified graph representation called a code property graph. This graph is stored in a custom graph database and queried using a Scala-based domain-specific language, allowing security researchers and developers to formulate complex searches for potential vulnerabilities and code patterns without needing language-specific analysis tools.
Joern suits teams focused on vulnerability research, security auditing, and static analysis at scale. It is particularly valuable for organizations that need to analyze codebases spanning multiple programming languages or that work with compiled artifacts like Java bytecode and binary executables. The platform requires JDK 21 and optionally gcc and g++ for C/C++ header discovery. Developers should be aware that the project has undergone significant architectural changes, including a migration from overflowdb to flatgraph and an upgrade from Scala 2 to Scala 3, which may affect compatibility with older code written against the platform.
The project maintains an automated release workflow that publishes new builds daily across multiple platforms including Linux x86_64 and ARM64, macOS x86_64 and ARM64, and Windows x86_64 and ARM64. Development activity centers on a Scala codebase with unit and integration test coverage, supported by an experimental Bazel build setup. The project provides comprehensive documentation including a specification for the code property graph standard and maintains an active community channel for user engagement.
