{"record":{"id":"f8826ac7361eca9e","repo":"jackwener/OpenCLI","slug":"osv-vulnerability-id-is-required-e-g-ghsa-29mw","errorCode":null,"errorMessage":"osv vulnerability id is required (e.g. \"GHSA-29mw-wpgm-hmr9\", \"CVE-2020-28500\")","messagePattern":"osv vulnerability id is required \\(e\\.g\\. \"GHSA-29mw-wpgm-hmr9\", \"CVE-2020-28500\"\\)","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"clis/osv/utils.js","lineNumber":43,"sourceCode":"    'Pub',\n    'Hex',\n    'Hackage',\n    'CRAN',\n    'Bitnami',\n    'GitHub Actions',\n    'SwiftURL',\n]);\n\nexport function requireString(value, label) {\n    const s = String(value ?? '').trim();\n    if (!s) throw new ArgumentError(`osv ${label} cannot be empty`);\n    return s;\n}\n\nexport function requireVulnId(value) {\n    const s = String(value ?? '').trim();\n    if (!s) {\n        throw new ArgumentError(\n            'osv vulnerability id is required (e.g. \"GHSA-29mw-wpgm-hmr9\", \"CVE-2020-28500\")',\n            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',\n        );\n    }\n    if (!VULN_ID.test(s)) {\n        throw new ArgumentError(\n            `osv vulnerability id \"${value}\" is not a valid OSV id`,\n            'IDs are short ASCII tokens like \"GHSA-...\", \"CVE-...\", \"PYSEC-...\".',\n        );\n    }\n    return s;\n}\n\nexport function requireEcosystem(value) {\n    const s = String(value ?? '').trim();\n    if (!s) {\n        throw new ArgumentError(\n            'osv --ecosystem is required when querying by package',","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/osv/utils.js#L25-L61","documentation":"requireVulnId first checks that a vulnerability ID was provided at all; an empty/whitespace value throws this ArgumentError with examples of valid ID shapes. The OSV API requires a concrete ID for lookups (e.g. GET /v1/vulns/{id}).","triggerScenarios":"Invoking the vulnerability lookup (id command) without an ID, with an empty string, or with a whitespace-only value; an unset variable used as the ID.","commonSituations":"Forgetting the positional ID argument; a script variable for the advisory ID left empty; copying a URL slug instead of the ID into the wrong slot.","solutions":["Pass the canonical ID, e.g. GHSA-29mw-wpgm-hmr9 or CVE-2020-28500.","If you only have a package name, use the query-by-package flow instead of ID lookup.","Find the canonical ID on https://osv.dev by searching the advisory title.","Check scripts for unset/empty ID variables."],"exampleFix":"// before\nconst id = requireVulnId(process.env.VULN_ID); // empty\n// after\nconst id = requireVulnId('GHSA-29mw-wpgm-hmr9');","handlingStrategy":"validation","validationCode":"if (!vulnId || String(vulnId).trim() === '') {\n  throw new Error('vulnerability id required, e.g. GHSA-29mw-wpgm-hmr9 or CVE-2020-28500');\n}","typeGuard":"const isNonEmptyVulnIdInput = (v) => typeof v === 'string' && v.trim().length > 0;","tryCatchPattern":"try {\n  const vuln = await osvVuln(id);\n} catch (e) {\n  if (e instanceof ArgumentError && /vulnerability id is required/.test(e.message)) {\n    console.error('Usage: osv vuln <GHSA-...|CVE-...>');\n    return;\n  }\n  throw e;\n}","preventionTips":["Keep canonical OSV IDs in your dependency-advisory records.","Make the ID a required positional argument in wrapper scripts.","Search https://osv.dev to obtain the canonical ID before lookup.","Never substitute package names where an ID is expected — use the query flow instead."],"tags":["argument-validation","input-validation","osv"],"backgroundTag":"missing-required-argument","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}