cve-triage 0.1.0

A Python library that parses dependency lockfiles, queries vulnerability databases (OSV.dev), and enriches results with EPSS scores.

cve-triage

cve-triage is a Python library that parses common dependency lockfiles, queries vulnerability databases (OSV.dev), and enriches the results with EPSS (Exploit Prediction Scoring System) scores. It returns structured, typed data optimized for programmatic consumption, CI/CD pipelines, and AI agent workflows.

Problem Statement

Identifying and prioritizing vulnerable dependencies is a fragmented process. Existing tools are often CLI-focused, produce unstructured output, or lack exploitability context (EPSS). AI agents and automated security pipelines need a reliable, programmatic way to parse lockfiles, fetch vulnerabilities, and prioritize them using exploitability scores without dealing with raw API responses or scraping.

Features

• Lockfile Parsing: Supports requirements.txt, poetry.lock, package-lock.json, and go.sum.
• Vulnerability Querying: Fetches known vulnerabilities via the OSV.dev API.
• EPSS Enrichment: Attaches EPSS scores and percentiles from FIRST.org to prioritize vulnerabilities.
• Structured Output: Returns fully typed Pydantic models, making it trivial to serialize to JSON for AI agents or APIs.
• Asynchronous API: Provides async methods for high-performance batch querying.
• Configurable Thresholds: Filter results by EPSS score or CVSS severity.

Installation