{"record":{"id":"d9c59de66d07c0ad","repo":"jackwener/OpenCLI","slug":"nvd-cve-id-value-is-not-a-valid-cve-identifie","errorCode":null,"errorMessage":"nvd CVE id \"${value}\" is not a valid CVE identifier","messagePattern":"nvd CVE id \"(.+?)\" is not a valid CVE identifier","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"clis/nvd/cve.js","lineNumber":18,"sourceCode":"// nvd cve — fetch a single CVE from the NIST National Vulnerability Database.\n//\n// Hits the CVE API 2.0 (`services.nvd.nist.gov/rest/json/cves/2.0?cveId=…`).\n// Returns the agent-useful projection: id, published / last-modified dates,\n// vuln status, English description, CVSS v3.1 base score / severity / vector,\n// CWE id(s), CISA KEV flag.\nimport { cli, Strategy } from '@jackwener/opencli/registry';\nimport { ArgumentError, CommandExecutionError, EmptyResultError } from '@jackwener/opencli/errors';\n\nconst NVD_BASE = 'https://services.nvd.nist.gov/rest/json/cves/2.0';\nconst UA = 'opencli-nvd-adapter (+https://github.com/jackwener/opencli)';\nconst CVE_ID = /^CVE-\\d{4}-\\d{4,}$/i;\n\nfunction requireCveId(value) {\n    const s = String(value ?? '').trim().toUpperCase();\n    if (!s) throw new ArgumentError('nvd CVE id is required (e.g. \"CVE-2021-44228\")');\n    if (!CVE_ID.test(s)) {\n        throw new ArgumentError(\n            `nvd CVE id \"${value}\" is not a valid CVE identifier`,\n            'Expected the form \"CVE-YYYY-N...\" with at least 4 sequence digits.',\n        );\n    }\n    return s;\n}\n\nfunction pickEnglishDescription(descriptions) {\n    if (!Array.isArray(descriptions)) return '';\n    const en = descriptions.find((d) => d?.lang === 'en');\n    return String(en?.value ?? descriptions[0]?.value ?? '').trim();\n}\n\nfunction pickPrimaryCvss(metrics) {\n    if (!metrics || typeof metrics !== 'object') return null;\n    const candidates = [\n        ...(Array.isArray(metrics.cvssMetricV31) ? metrics.cvssMetricV31 : []),\n        ...(Array.isArray(metrics.cvssMetricV30) ? metrics.cvssMetricV30 : []),","sourceCodeStart":1,"sourceCodeEnd":36,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/nvd/cve.js#L1-L36","documentation":"This ArgumentError is thrown by requireCveId in clis/nvd/cve.js when a CVE id argument fails the regex /^CVE-\\d{4}-\\d{4,}$/i after trimming and uppercasing. The library requires the canonical NVD form \"CVE-YYYY-N...\" with a 4-digit year and at least 4 sequence digits. It is a client-side input guard so malformed ids never reach the NVD API.","triggerScenarios":"Calling id() (via requireCveId) with values like \"2021-44228\", \"CVE-21-44228\", \"cve-2021-123\" (only 3 sequence digits), \"CVE-2021-44228 \", or an empty/null argument (that hits the separate empty-id error but the same function).","commonSituations":"Users paste CVE ids with extra prose (\"CVE-2021-44228 (Log4Shell)\"), omit the \"CVE-\" prefix, use short forms seen in changelogs, or pass a shell variable that is empty or contains a URL fragment.","solutions":["Reformat the id as CVE-YYYY-N with the full year and at least 4 sequence digits, e.g. CVE-2021-44228.","Strip surrounding text/quotes and trim whitespace before passing the value.","Validate locally with /^CVE-\\d{4}-\\d{4,}$/i before calling the command.","If only a sequence number is known, look up the year it was assigned (or use NVD keyword search instead of cveId lookup)."],"exampleFix":"// before\nnvd cve \"log4shell\"\n// after\nnvd cve \"CVE-2021-44228\"","handlingStrategy":"validation","validationCode":"const CVE_ID = /^CVE-\\d{4}-\\d{4,}$/i;\nconst id = String(raw ?? '').trim().toUpperCase();\nif (!CVE_ID.test(id)) throw new Error(`invalid CVE id: ${raw}`);","typeGuard":"const isCveId = (v) => typeof v === 'string' && /^CVE-\\d{4}-\\d{4,}$/i.test(v.trim());","tryCatchPattern":"try { const id = requireCveId(raw); } catch (e) { if (e instanceof ArgumentError) { console.error('Usage: cve CVE-YYYY-NNNN'); } else { throw e; } }","preventionTips":["Normalize ids: trim, strip quotes/prose, uppercase before use.","Keep a shared CVE_ID regex constant in your codebase.","Reject ids pasted with surrounding context (advisory text, URLs)."],"tags":["validation","input-error","cve","argument-error"],"backgroundTag":"invalid-cve-identifier","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}