cve-check

CVE check

When to use

• The user asks whether a package version is vulnerable, or which version fixes an advisory.
• Before pinning, adding or upgrading to a specific version.
• When a rule's "Known vulnerabilities" table needs live verification (those tables go stale).

For a whole-project scan use security-audit. For a package that isn't installed yet use dependency-vet first.

Before you start

• Get the exact package name, ecosystem and installed version. Read the version from the lockfile, not the manifest range.
• OSV ecosystem names: npm, PyPI, Go, crates.io, Packagist, RubyGems, NuGet, Maven (name as group:artifact), Pub. GitHub uses lowercase: npm, pip, go, rust, composer, rubygems, nuget, maven, pub.
• These lookups use public APIs. gh api uses the user's GitHub login, which raises rate limits; plain curl against api.github.com is limited to 60 requests an hour.

Steps

1. Query OSV for the version. It aggregates GHSA, PyPA, RustSec, Go and malware (MAL-) databases.

   curl -s -X POST https://api.osv.dev/v1/query \
     -d '{"package":{"name":"next","ecosystem":"npm"},"version":"16.4.0"}' \
     | jq -r '.vulns[]? | [.id, ((.aliases // []) | map(select(startswith("CVE-"))) | join(",")),
         (.database_specific.severity // "?"),
         ([.affected[] | select(.package.name=="next") | .ranges[]?.events[]? | select(.fixed) | .fixed] | join(" ")),
         .summary] | @tsv'
   

   For several packages at once, POST https://api.osv.dev/v1/querybatch with {"queries":[…]} returns IDs only. Fetch details per ID:

   curl -s https://api.osv.dev/v1/vulns/GHSA-p3m5-59mp-jv5r \
     | jq '{id, aliases, published, severity: [.severity[]?.score], affected: [.affected[] | {pkg: .package.name, events: [.ranges[]?.events[]?]}], refs: [.references[]?.url][0:5]}'
   

2. Query the GitHub Advisory Database for the same version, to cross-check severity, CVSS, EPSS and the first patched version: