cve-analysis

Files (1)

• SKILL.md

SKILL.md (first lines)

# CVE Analysis

## GitHub advisory

Use first. Has scores, fixed version per release line, fix links, EPSS. Use `cve_id=` or `ghsa_id=`.

```shell
gh api "advisories?cve_id=CVE-2025-12345" --jq '.[] |
  "\(.ghsa_id) \(.cve_id) \(.severity) v3=\(.cvss_severities.cvss_v3.score) v4=\(.cvss_severities.cvss_v4.score) epss=\(.epss.percentage) \(.type)",
  .summary,
  (.vulnerabilities[] | "  \(.package.ecosystem):\(.package.name) \(.vulnerable_version_range) fixed=\(.first_patched_version)"),
  (.references[] | "  \(.)")'
```

Add `.description` for details (can be long).

Many CVEs in one request (GraphQL, reviewed advisories only; use the REST call above for `unreviewed`):

```shell
q='query {'; i=0; for c in CVE-2025-12345 CVE-2025-23456; do
  q="$q c$i: securityAdvisories(first: 1, identifier: {type: CVE, value: \"$c\"}) { nodes { ghsaId summary severity cvss { score } identifiers { type value } vulnerabilities(first: 50) { nodes { package { ecosystem name } vulnerableVersionRange firstPatchedVersion { identifier } } } } }"; i=$((i+1)); done
gh api graphql -f query="$q }" --jq '.data | to_entries[] | .value.nodes[] |
  "\([.identifiers[] | select(.type=="CVE") | .value][0]) \(.ghsaId) \(.severity) \(.cvss.score) \(.summary)",
  (.vulnerabilities.nodes[] | "  \(.package.ecosystem):\(.package.name) \(.vulnerableVersionRange) fixed=\(.firstPatchedVersion.identifier)")'
```

A CVE missing from the output has no reviewed advisory.

## CVE.org

Use when GitHub has no advisory, to get the CNA score, or to check exploitation: CISA `ssvc` (`Exploitation: none|poc|active`) and `kev` (in the Known Exploited Vulnerabilities catalog).

```shell
curl -s https://cveawg.mitre.org/api/cve/CVE-2025-12345 | jq -r '
  .containers.cna.title // .containers.cna.descriptions[0].value,
  ([.containers.cna] + (.containers.adp // []) | .[] | .providerMetadata.shortName as $p
    | .metrics[]? | to_entries[]
    | if .key | startswith("cvss") then "\($p) \(.key) \(.value.baseScore) \(.value.baseSeverity) \(.value.vectorString)"
      elif .key == "other" then "\($p) \(.value.type) \(.value.content | del(.id, .role, .version, .timestamp) | tostring)"
      else empty end),
  (.containers.cna.references[]?.url)'
```

## OSV

Use for OSV-native IDs (`GO-`, `PYSEC-`, `RUSTSEC-`, distro IDs), aliases, related distro advisories, and fix commits.

```shell
curl -s https://api.osv.dev/v1/vulns/GO-2024-1234 | jq -r '
  "aliases: \(.aliases // [] | join(", "))",
  "related: \(.related // [] | join(", "))",
  (.affected[]? | "\(.package.ecosystem):\(.package.name) " + ([.ranges[]?.events[]? | to_entries[] | "\(.key)=\(.value)"] | join(" ")))'
```

Known vulnerabilities for package versions, many packages in one request:

```shell
curl -s -X POST https://api.osv.dev/v1/querybatch -d '{"queries": [
  {"package": {"ecosystem": "Maven", "name": "org.example:example-lib"}, "version": "2.4.1"},
  {"package": {"ecosystem": "Go", "name": "stdlib"}, "version": "1.22.0"},
  {"package": {"ecosystem": "Debian:12", "name": "openssl"}, "version": "3.0.11-1~deb12u2"},
  {"package": {"ecosystem": "Alpine:v3.19", "name": "openssl"}, "version": "3.1.4-r0"},
  {"package": {"purl": "pkg:npm/example@1.0.0"}}
]}' | jq -r '.results[] | [.vulns[]?.id] | join(", ")'
```

Other ecosystems: `npm`, `PyPI`, `crates.io`, `RubyGems`, `NuGet`, `Ubuntu:22.04:LTS`. Distro packages use the source package name and the distro version string.

## Scan what the build resolves

One scan for all dependencies, using the versions the build actually resolves. Prefer this over checking packages one by one or reading BOMs.

```shell
osv-scanner scan source -r <dir> --format json --output-file /tmp/osv.json             # lockfiles: go.mod, uv.lock, poetry.lock, requirements.txt, package-lock.json, Cargo.lock, ...
osv-scanner scan source --x-plugins go/binary <binary> --format json --output-file /tmp/osv.json   # built Go binary
osv-scanner scan image <image> --format json --output-file /tmp/osv.json               # container image
```

Maven has no lockfile. Use Maven's own dependency resolution: generate a CycloneDX SBOM from the build and scan it. Do not let osv-scanner resolve `pom.xml`, and do not scan jar files.

```shell
mvn org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeBom -pl <module> -DoutputFormat=json -DoutputName=bom -DincludeTestScope=false
osv-scanner scan -L <module>/target/bom.json --format json --output-file /tmp/osv.json
```

Summarize results:

```shell
jq -r '.results[] | .source.path as $s | .packages[] | "\(.package.name) \(.package.version): " + ([.vulnerabilities[] | ((.aliases // []) | map(select(startswith("CVE"))) | first) // .id] | unique | join(" ")) + "  [\($s)]"' /tmp/osv.json
```

Add `--all-packages` to osv-scanner to list every resolved package and version, not only vulnerable ones.

Check a resolved version directly:

```shell
go list -m all                                          # Go: module graph of the source tree
go version -m <binary>                                  # Go: modules embedded in a built binary, and the Go version (stdlib CVEs)
mvn dependency:tree -pl <module> -Dincludes=<groupId>[:<artifactId>]   # Maven
```

## Release tags containing a fix

Backports are separate commits. Find them through the shared issue or PR number, or the cherry-pick trailer, then check tags.

Local git:

```shell
git log --all --format='%h %s' -E --grep='#49570([^0-9]|$)' --grep='cherry picked from commit <sha>'
git log --all --format=%H -E --grep='#49570([^0-9]|$)' --grep='cherry picked from commit <sha>' \
  | xargs -n1 git tag --contains | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -uV
```

gh (no clone). Find backport PRs, then the first tag on each release line that contains the merge commit (`ahead` or `identical` = included):

```shell
gh pr list --repo <owner>/<repo> --state merged --search '49570' --json number,baseRefName,mergeCommit,title \
  --jq '.[] | "#\(.number) \(.baseRefName) \(.mergeCommit.oid) \(.title)"'

From tsaarni/agent-skills, Apache-2.0.

More from tsaarni/agent-skills