cve-research

It queries OSV.dev first for speed and accuracy, cross-checks NVD for CVSS scoring, uses Exa for recent advisories, and checks GitHub Advisory for maintainer responses, then cross-references findings and prioritizes by CVSS score and exploitability — CRITICAL (9.0-10.0) fixed immediately, HIGH (7.0-8.9) before merge, MEDIUM (4.0-6.9) planned, LOW (0.1-3.9) documented — reporting fix versions and workarounds.

Out of scope: this is a single-dependency lookup, not a full project dependency sweep (use dependency-audit for that).

CVE Research Skill

Overview

Research known vulnerabilities for project dependencies using multiple sources.

Data Sources

Source	API	Coverage
NVD	nvd.nist.gov/vuln/api	All CVEs
OSV.dev	api.osv.dev	npm, PyPI, Go, crates, Maven
GitHub Advisory	github.com/advisories	npm, pip, composer, cargo
Exa Search	Via MCP	Real-time web search

Workflow

1. Extract dependencies from project (package.json, etc.)
2. Query each source for known CVEs
3. Cross-reference findings across sources
4. Prioritize by CVSS score and exploitability
5. Report with fix versions and workarounds

Query Strategy

For each dependency:

1. Search OSV.dev first (fastest, most accurate for packages)
2. Cross-check NVD for CVSS scoring
3. Use Exa for recent advisories not yet in databases
4. Check GitHub Advisory for maintainer responses

Severity Mapping

CVSS Score	Severity	Action
9.0 - 10.0	CRITICAL	Fix immediately
7.0 - 8.9	HIGH	Fix before merge
4.0 - 6.9	MEDIUM	Plan fix
0.1 - 3.9	LOW	Document

References

• CVE APIs Reference
• Query Templates