Cve Triage · fedius01 bundle Triage a single vulnerability — CVE, GHSA, or OSV/PYSEC id — against the current Python repository (Poetry or uv) using Risk-Based Vulnerability Management. Use when a teammate asks to "triage CVE-YYYY-NNNN", "triage GHSA-xxxx-xxxx-xxxx", "is this CVE exploitable here", "should we fix it", "pip-audit flagged it", "SSVC this CVE", "write a VEX for PYSEC-YYYY-NN", or "give me a CycloneDX VEX for Dependency-Track". Reads whichever of poetry.lock or uv.lock the repo has. Takes the id first, an optional output format (cyclonedx | openvex | both) second. Gathers CVSS, EPSS, KEV, reachability and exposure evidence, produces an SSVC Deployer decision (Immediate / Out-of-cycle / Scheduled / Defer), and writes to security/triage/<vuln-id>/ a CycloneDX VEX naming every known CVE/GHSA/OSV id — so Dependency-Track matches whichever id the finding was filed under — plus a human-readable decision record. Not for explaining CVEs in the abstract, running scans, or triaging batches of CVEs.
