vulnerability-csv-reporting git:20260424.d50cf5aA

Immutable. This exact content never changes and is served at /api/v1/blob/eb11939ed2be919b.

---
name: vulnerability-csv-reporting
description: Generate structured CSV security audit reports from Trivy JSON vulnerability data with severity filtering and proper field mapping.
---

# Vulnerability CSV Reporting

## CSV Schema

```
Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url
```

## Complete Report Generator

```python
import json
import csv

def get_cvss_score(vuln):
    cvss = vuln.get('CVSS', {})
    for source in ['nvd', 'ghsa', 'redhat']:
        if source in cvss:
            score = cvss[source].get('V3Score')
            if score is not None:
                return score
    return 'N/A'

def generate_csv_report(json_input, csv_output, severity_filter=('HIGH', 'CRITICAL')):
    with open(json_input, 'r', encoding='utf-8') as f:
        data = json.load(f)

    headers = ["Package", "Version", "CVE_ID", "Severity",
               "CVSS_Score", "Fixed_Version", "Title", "Url"]

    rows = []
    for result in data.get('Results', []):
        for vuln in result.get('Vulnerabilities', []):
            if vuln.get('Severity') in severity_filter:
                rows.append({
                    "Package": vuln.get('PkgName', 'N/A'),
                    "Version": vuln.get('InstalledVersion', 'N/A'),
                    "CVE_ID": vuln.get('VulnerabilityID', 'N/A'),
                    "Severity": vuln.get('Severity', 'N/A'),
                    "CVSS_Score": get_cvss_score(vuln),
                    "Fixed_Version": vuln.get('FixedVersion') or 'N/A',
                    "Title": vuln.get('Title', 'N/A'),
                    "Url": vuln.get('PrimaryURL', 'N/A'),
                })

    with open(csv_output, 'w', newline='', encoding='utf-8') as f:
        writer = csv.DictWriter(f, fieldnames=headers)
        writer.writeheader()
        writer.writerows(rows)

    print(f"[+] {len(rows)} vulnerabilities written to {csv_output}")
    return rows
```

## Key Notes

- Use `newline=''` in `open()` to prevent extra blank lines on Windows
- Use `or 'N/A'` (not `.get(..., 'N/A')`) for FixedVersion since it may be present but empty string
- `csv.DictWriter` automatically handles quoting of fields containing commas