vulnerability-json-parsing

name	vulnerability-json-parsing
description	Extracting specific security metadata (CVE, CVSS, Fix versions) from structured vulnerability reports like npm audit JSON or OSV.

Extracting Metadata

When parsing the JSON output from a security audit tool (like npm audit --json), focus on the following fields within the advisories or vulnerabilities objects:

1. Package Name: The key or name field in the vulnerability object.
2. Installed Version: Cross-referenced from the package-lock.json or the version field in the audit report.
3. CVE ID: Found under cves (array) or identifiers. Use the primary CVE ID (e.g., CVE-2023-xxxx). If unavailable, look for GHSA (GitHub Security Advisory) IDs.
4. Severity: The severity field (e.g., high, critical).
5. CVSS Score: Often found under cvss.score or within the advisory metadata. If missing from the local audit, it may need to be fetched via the reference URL provided.
6. Fixed Version: Look for fixAvailable.version or patched_versions. If no patch is available, denote as N/A.
7. Title/Description: Found in the title or summary field.
8. Reference URL: Found in the url or references array.

Python Processing Example

Use the json and csv modules in Python to transform the audit data:

import json
import csv

def extract_vulnerabilities(json_data):
    results = []
    # Logic to iterate through JSON nodes, filter by severity,
    # and map to the target CSV columns.
    return results