jackwener/OpenCLI · error · ArgumentError

nvd CVE id is required (e.g. "CVE-2021-44228")

Error message

nvd CVE id is required (e.g. "CVE-2021-44228")

What it means

This ArgumentError is thrown by requireCveId in clis/nvd/cve.js when the CVE id argument is empty, undefined, or only whitespace. Looking up a CVE in the NVD API requires the id, and the library validates its presence client-side before making any request. The message shows the expected format.

Source

Thrown at clis/nvd/cve.js:16

// nvd cve — fetch a single CVE from the NIST National Vulnerability Database.
//
// Hits the CVE API 2.0 (`services.nvd.nist.gov/rest/json/cves/2.0?cveId=…`).
// Returns the agent-useful projection: id, published / last-modified dates,
// vuln status, English description, CVSS v3.1 base score / severity / vector,
// CWE id(s), CISA KEV flag.
import { cli, Strategy } from '@jackwener/opencli/registry';
import { ArgumentError, CommandExecutionError, EmptyResultError } from '@jackwener/opencli/errors';

const NVD_BASE = 'https://services.nvd.nist.gov/rest/json/cves/2.0';
const UA = 'opencli-nvd-adapter (+https://github.com/jackwener/opencli)';
const CVE_ID = /^CVE-\d{4}-\d{4,}$/i;

function requireCveId(value) {
    const s = String(value ?? '').trim().toUpperCase();
    if (!s) throw new ArgumentError('nvd CVE id is required (e.g. "CVE-2021-44228")');
    if (!CVE_ID.test(s)) {
        throw new ArgumentError(
            `nvd CVE id "${value}" is not a valid CVE identifier`,
            'Expected the form "CVE-YYYY-N..." with at least 4 sequence digits.',
        );
    }
    return s;
}

function pickEnglishDescription(descriptions) {
    if (!Array.isArray(descriptions)) return '';
    const en = descriptions.find((d) => d?.lang === 'en');
    return String(en?.value ?? descriptions[0]?.value ?? '').trim();
}

function pickPrimaryCvss(metrics) {
    if (!metrics || typeof metrics !== 'object') return null;
    const candidates = [

View on GitHub (pinned to 49907e53dc)

Solutions

1. Supply a CVE id, e.g. nvd cve CVE-2021-44228
2. Check that the variable feeding the id is set and non-empty
3. If you only have keywords, use the NVD keyword/search command instead of id lookup

Example fix

// before
await nvd.cve(ctx, { id: process.env.CVE }); // CVE unset
// after
await nvd.cve(ctx, { id: process.env.CVE || 'CVE-2021-44228' });

const CVE_ID = /^CVE-\d{4}-\d{4,}$/i;
if (!id || !CVE_ID.test(String(id).trim())) throw new Error('CVE id is required, e.g. CVE-2021-44228');

function isValidCveId(v) { return typeof v === 'string' && /^CVE-\d{4}-\d{4,}$/i.test(v.trim()); }

try {
  await nvd.cve(ctx, { id });
} catch (e) {
  if (e instanceof ArgumentError && e.message.includes('CVE id is required')) {
    console.error('Usage: pass --id CVE-YYYY-NNNN');
  } else throw e;
}

When it happens

Trigger: Calling the nvd cve id lookup with no argument, an empty string, or a variable that is unset/null in a script or CI job.

Common situations: Forgetting the positional CVE argument on the CLI; environment variables or spreadsheet columns that are blank; automation pipelines where an upstream step failed to produce a CVE id.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• nuget package id is required (e.g. "Newtonsoft.Json")
• ${label} is required
• ${label} must be a positive integer
• ${label} must be <= ${maxValue}
• arxiv ${label} must be a positive integer

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/35b2268ee560f39a. Report an issue: GitHub.