| name | cve-acknowledge |
| description | Triage a CVE issue from Jira. Read the CVE details, assess the impact and provide instructions on how to solve a given issue. |
cve-acknowledge
The user provides a Jira key (e.g., DVO-415) or a Jira URL.
If no specific issue is given, find vulnerability issues to triage that are in status other than Done, by using the following JQL.
project = "DVO" AND resolution = Unresolved AND issuetype = Vulnerability
Step 1: Find the CVE issue
Fetch the issue via getJiraIssues with
responseContentFormat: "markdown". The issue type is
Vulnerability, not a regular story.
Parse the data from these locations:
- CVE ID — embedded in the
summary field, e.g.,
CVE-2026-33231 dvo/deployment-validation-operator...: NLTK: ...
- Affected Component — mentioned in the field
Upstream Affected Component
- Existing fix — in the external links of the issue check for a link to
https://pkg.go.dev that may include the version of the patched library needed.
Then look up severity externally:
- CVSS score — use
WebSearch for the CVE ID on NVD
(e.g., CVE-2026-33231 NVD) to get the severity rating
If the issue is missing a CVE ID or the affected package
is unclear from the flaw text, ask the user to clarify.
Step 2: Present Assessment
Present the finding to the user clearly:
CVE Assessment: {CVE-ID}
Package: {package name}
Vulnerable versions: {range}
Used version: {version from go.mod}
Patched version: {version from pkg.go.dev with the patched library version}
Report to the user the actions needed to fix the problem (e.g. the Go version needs to be bumped to 1.25.9).
