jackwener/OpenCLI · error · ArgumentError

osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9"

Error message

osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9", "CVE-2020-28500")

What it means

requireVulnId first checks that a vulnerability ID was provided at all; an empty/whitespace value throws this ArgumentError with examples of valid ID shapes. The OSV API requires a concrete ID for lookups (e.g. GET /v1/vulns/{id}).

Source

Thrown at clis/osv/utils.js:43

    'Pub',
    'Hex',
    'Hackage',
    'CRAN',
    'Bitnami',
    'GitHub Actions',
    'SwiftURL',
]);

export function requireString(value, label) {
    const s = String(value ?? '').trim();
    if (!s) throw new ArgumentError(`osv ${label} cannot be empty`);
    return s;
}

export function requireVulnId(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9", "CVE-2020-28500")',
            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',
        );
    }
    if (!VULN_ID.test(s)) {
        throw new ArgumentError(
            `osv vulnerability id "${value}" is not a valid OSV id`,
            'IDs are short ASCII tokens like "GHSA-...", "CVE-...", "PYSEC-...".',
        );
    }
    return s;
}

export function requireEcosystem(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv --ecosystem is required when querying by package',

View on GitHub (pinned to 49907e53dc)

Solutions

1. Pass the canonical ID, e.g. GHSA-29mw-wpgm-hmr9 or CVE-2020-28500.
2. If you only have a package name, use the query-by-package flow instead of ID lookup.
3. Find the canonical ID on https://osv.dev by searching the advisory title.
4. Check scripts for unset/empty ID variables.

Example fix

// before
const id = requireVulnId(process.env.VULN_ID); // empty
// after
const id = requireVulnId('GHSA-29mw-wpgm-hmr9');

if (!vulnId || String(vulnId).trim() === '') {
  throw new Error('vulnerability id required, e.g. GHSA-29mw-wpgm-hmr9 or CVE-2020-28500');
}

const isNonEmptyVulnIdInput = (v) => typeof v === 'string' && v.trim().length > 0;

try {
  const vuln = await osvVuln(id);
} catch (e) {
  if (e instanceof ArgumentError && /vulnerability id is required/.test(e.message)) {
    console.error('Usage: osv vuln <GHSA-...|CVE-...>');
    return;
  }
  throw e;
}

When it happens

Trigger: Invoking the vulnerability lookup (id command) without an ID, with an empty string, or with a whitespace-only value; an unset variable used as the ID.

Common situations: Forgetting the positional ID argument; a script variable for the advisory ID left empty; copying a URL slug instead of the ID into the wrong slot.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• osv ${label} cannot be empty
• ${label} must be a non-negative integer, got ${JSON.stringif
• limit must be a positive integer
• archive wayback timestamp must be YYYY[MM[DD[hh[mm[ss]]]]] o
• archive wayback url cannot be empty

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/f8826ac7361eca9e. Report an issue: GitHub.