vulnerability-csv-report-generation

name	vulnerability-csv-report-generation
description	How to generate a properly formatted CSV security audit report from vulnerability scan results, including handling of special characters and proper escaping.

CSV Report Generation for Security Audits

Required Columns

Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url

Python CSV Generation

import csv

def write_audit_csv(vulnerabilities, output_path):
    """
    Write vulnerability findings to CSV.
    
    vulnerabilities: list of dicts with keys:
        package, version, cve_id, severity, cvss_score, 
        fixed_version, title, url
    """
    fieldnames = [
        'Package', 'Version', 'CVE_ID', 'Severity',
        'CVSS_Score', 'Fixed_Version', 'Title', 'Url'
    ]
    
    with open(output_path, 'w', newline='') as f:
        writer = csv.DictWriter(f, fieldnames=fieldnames)
        writer.writeheader()
        
        for vuln in vulnerabilities:
            writer.writerow({
                'Package': vuln['package'],
                'Version': vuln['version'],
                'CVE_ID': vuln.get('cve_id', 'N/A'),
                'Severity': vuln['severity'].upper(),
                'CVSS_Score': vuln.get('cvss_score', 'N/A'),
                'Fixed_Version': vuln.get('fixed_version', 'N/A'),
                'Title': vuln.get('title', '').replace('\n', ' '),
                'Url': vuln.get('url', 'N/A')
            })

# Sorting - typically by severity then CVSS score
vulnerabilities.sort(key=lambda x: (
    0 if x['severity'].upper() == 'CRITICAL' else 1,
    -float(x.get('cvss_score', 0) or 0)
))

Important Considerations

1. Deduplication: Same CVE may appear for the same package at different paths. Deduplicate by (package, version, cve_id) tuple.

2. CVE ID handling: Some advisories only have GHSA IDs. Map GHSA to CVE when possible. If no CVE, use GHSA ID.

3. CVSS Score sources (priority order):

   • NVD (National Vulnerability Database)
   • GHSA (GitHub Security Advisory)
   • RedHat Security

4. Fixed Version:

   • Extract from patched_versions field in npm audit
   • Or fix.versions in grype
   • Or FixedVersion in trivy
   • If unavailable, write N/A

5. Severity filtering: Only include HIGH and CRITICAL:

   if vuln['severity'].upper() in ('HIGH', 'CRITICAL'):
       filtered.append(vuln)
   

6. CSV escaping: The csv module handles quoting automatically. Titles/descriptions may contain commas and quotes.