Post

Oh nice, the CVE program now ships an official JS library for validating CVE records before submitting them. I originally pitched this at a CVE Quality Working group meeting. Glad it’s out now!

This solves a problem for CNAs. They want to know their records will be accepted by CVE Services’ REST API, with a clear separation between internal drafting (where private/sensitive info might slip in) and publication after internal approval.

Previously, the best you could do was check against the official JSON schema, but that didn’t cover all the checks that the REST API actually does. This library fixes that. It’s JSON schema validation plus all the other checks, and it’s used inside the API itself so the library won’t drift.