Vulnerability CSV Reporting

Overview

Convert vulnerability scan results (JSON) into a structured CSV report suitable for security audits.

CSV Schema

Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url

Python Implementation

import csv
import json

def generate_csv(trivy_json_path, output_csv_path):
    with open(trivy_json_path) as f:
        data = json.load(f)

    rows = []
    for result in data.get("Results", []):
        for vuln in result.get("Vulnerabilities", []):
            cvss = vuln.get("CVSS", {})
            score = extract_cvss_score(cvss)
            fixed = vuln.get("FixedVersion", "N/A") or "N/A"
            title = vuln.get("Title") or vuln.get("Description", "")[:120] or ""
            rows.append({
                "Package": vuln.get("PkgName", ""),
                "Version": vuln.get("InstalledVersion", ""),
                "CVE_ID": vuln.get("VulnerabilityID", ""),
                "Severity": vuln.get("Severity", ""),
                "CVSS_Score": score,
                "Fixed_Version": fixed,
                "Title": title,
                "Url": vuln.get("PrimaryURL", ""),
            })

    with open(output_csv_path, "w", newline="") as f:
        writer = csv.DictWriter(f, fieldnames=[
            "Package", "Version", "CVE_ID", "Severity",
            "CVSS_Score", "Fixed_Version", "Title", "Url"
        ])
        writer.writeheader()
        writer.writerows(rows)

Key Considerations

• Use csv.DictWriter for reliable CSV output (handles quoting/escaping)
• Fixed version may be empty — default to "N/A"
• Title may be missing — fall back to truncated Description
• Deduplicate if needed (same CVE for same package)