Cve Scanner

CVE Scanner

Description

Given a list of package names and versions, query the OSV database for known vulnerabilities.

When to Use

• Security audit of project dependencies
• CI/CD gate to block vulnerable packages

When NOT to Use

• Runtime production scanning (too slow for hot paths)

Inputs

Outputs

Example

import requests

def scan_packages(packages: list) -> dict:
    '''
    Uses OSV.dev API — free and no auth required.
    '''
    vulns = []
    for pkg in packages:
        resp = requests.post(
            "https://api.osv.dev/v1/query",
            json={"package": {"name": pkg["name"], "ecosystem": pkg.get("ecosystem", "PyPI")},
                  "version": pkg["version"]}
        )
        resp.raise_for_status()
        results = resp.json().get("vulns", [])
        for v in results:
            vulns.append({
                "package": pkg["name"],
                "version": pkg["version"],
                "id": v.get("id"),
                "summary": v.get("summary", "No summary"),
                "severity": v.get("database_specific", {}).get("severity", "UNKNOWN"),
            })
    safe = len(packages) - len({v["package"] for v in vulns})
    return {"vulnerabilities": vulns, "safe_count": safe}

# packages = [
#     {"name": "requests", "version": "2.25.0", "ecosystem": "PyPI"},
#     {"name": "flask", "version": "0.12.2", "ecosystem": "PyPI"},
# ]
# report = scan_packages(packages)
# print(f"Found {len(report['vulnerabilities'])} vulnerabilities")