cve-acknowledge

name	cve-acknowledge
description	Triage a CVE issue from Jira. Read the CVE details, assess the impact and provide instructions on how to solve a given issue.

cve-acknowledge

The user provides a Jira key (e.g., DVO-415) or a Jira URL. If no specific issue is given, find vulnerability issues to triage that are in status other than Done, by using the following JQL.

project = "DVO" AND resolution = Unresolved AND issuetype = Vulnerability

Step 1: Find the CVE issue

Fetch the issue via getJiraIssues with responseContentFormat: "markdown". The issue type is Vulnerability, not a regular story.

Parse the data from these locations:

• CVE ID — embedded in the summary field, e.g., CVE-2026-33231 dvo/deployment-validation-operator...: NLTK: ...
• Affected Component — mentioned in the field Upstream Affected Component
• Existing fix — in the external links of the issue check for a link to https://pkg.go.dev that may include the version of the patched library needed.

Then look up severity externally:

• CVSS score — use WebSearch for the CVE ID on NVD (e.g., CVE-2026-33231 NVD) to get the severity rating

If the issue is missing a CVE ID or the affected package is unclear from the flaw text, ask the user to clarify.

Step 2: Present Assessment

Present the finding to the user clearly:

CVE Assessment: {CVE-ID}

Package: {package name}
Vulnerable versions: {range}
Used version: {version from go.mod}
Patched version: {version from pkg.go.dev with the patched library version}

Report to the user the actions needed to fix the problem (e.g. the Go version needs to be bumped to 1.25.9).