What is OSV?

OSV is a schema, defined in the ossf/osv-schema repository and documented on the cited page. The page states its purpose as a standard interchange format that all vulnerability databases can export. The goal is to let tools and people work with many databases more easily, and to support automated, accurate management of open source dependency vulnerabilities.

Each record has a required id of the form database name, a dash, and an entry identifier, plus a required modified timestamp. Summary and details fields hold descriptions, severity holds scores such as CVSS vectors, and aliases and related fields link to records in other databases. The affected field says which packages and versions are vulnerable. Each entry names a package by ecosystem and name, with an optional package URL, and gives either a list of versions or ranges. A version counts as affected if it falls inside any listed range or appears in the versions list.

The core schema is kept minimal. Customization goes into ecosystem_specific and database_specific fields. The page lists Oliver Chang and Russ Cox as the original authors and invites feedback through the repository's issue tracker. It shows the schema version as 1.9.2.