Post

Oh nice, the CVE program now ships an official JS library for validating CVE records before submitting them. I originally pitched this at a CVE Quality Working group meeting. Glad it’s out now!

medium.comIntroducing the CVE Program Validation LibraryCVE Record support vulnerability disclosure, security tools, and the organizations that use them to manage risk. Their value depends on…

Andrew Lilley Brinker

@alilleybrinker.com

This solves a problem for CNAs. They want to know their records will be accepted by CVE Services’ REST API, with a clear separation between internal drafting (where private/sensitive info might slip in) and publication after internal approval.

25/10/26, 11:27 pm0 reposts2 likes

Andrew Lilley Brinker

@alilleybrinker.com

Previously, the best you could do was check against the official JSON schema, but that didn’t cover all the checks that the REST API actually does. This library fixes that. It’s JSON schema validation plus all the other checks, and it’s used inside the API itself so the library won’t drift.

Andrew Lilley Brinker

@alilleybrinker.com

There’s more to do for improving the experience of working with CVE Records (IMO defining clear versioning rules should be a top priority), but this is a valuable step to make life easier for the roughly 550 CNAs enrolled in the program.