jackwener/OpenCLI · error · ArgumentError

osv vulnerability id "${value}" is not a valid OSV id

Error message

osv vulnerability id "${value}" is not a valid OSV id

What it means

After the non-empty check, requireVulnId validates the value against VULN_ID (an ASCII token of 1-80 chars starting alphanumeric). Values containing spaces, slashes, URLs, or other non-token characters are rejected as not valid OSV ids.

Source

Thrown at clis/osv/utils.js:49

    'SwiftURL',
]);

export function requireString(value, label) {
    const s = String(value ?? '').trim();
    if (!s) throw new ArgumentError(`osv ${label} cannot be empty`);
    return s;
}

export function requireVulnId(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9", "CVE-2020-28500")',
            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',
        );
    }
    if (!VULN_ID.test(s)) {
        throw new ArgumentError(
            `osv vulnerability id "${value}" is not a valid OSV id`,
            'IDs are short ASCII tokens like "GHSA-...", "CVE-...", "PYSEC-...".',
        );
    }
    return s;
}

export function requireEcosystem(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv --ecosystem is required when querying by package',
            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,
        );
    }
    if (!OSV_ECOSYSTEMS.has(s)) {
        throw new ArgumentError(
            `osv --ecosystem "${value}" is not a recognised OSV ecosystem`,

View on GitHub (pinned to 49907e53dc)

Solutions

1. Extract just the ID token from the URL (the last path segment).
2. Strip surrounding quotes, spaces, and punctuation from the pasted value.
3. Use a recognized format: GHSA-xxxx-xxxx-xxxx, CVE-YYYY-NNNN, PYSEC-YYYY-NN, etc.
4. Confirm the ID exists at https://osv.dev.

Example fix

// before
requireVulnId('https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9');
// after
requireVulnId('GHSA-29mw-wpgm-hmr9');

const VULN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
if (!VULN_ID_RE.test(String(vulnId ?? '').trim())) {
  throw new Error(`"${vulnId}" is not a valid OSV id (expected GHSA-..., CVE-..., PYSEC-...)`);
}

const isValidOsvId = (v) =>
  typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(v.trim());

try {
  const vuln = await osvVuln(id);
} catch (e) {
  if (e instanceof ArgumentError && /not a valid OSV id/.test(e.message)) {
    console.error(`Invalid id "${id}" — extract the bare token, e.g. GHSA-29mw-wpgm-hmr9`);
    return;
  }
  throw e;
}

When it happens

Trigger: Passing something like a full advisory URL (https://osv.dev/vulnerability/GHSA-...), an ID with a typo or trailing whitespace/quotes, or a non-OSV identifier format.

Common situations: Pasting the whole osv.dev URL instead of just the ID; copying an ID with trailing punctuation from a PDF/chat; using an internal ticket ID rather than a GHSA/CVE/PYSEC id.

Related errors

• ${raw} is not a Douyin sec_uid
• osv ${label} cannot be empty
• osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9"
• osv --ecosystem "${value}" is not a recognised OSV ecosystem
• Unknown 12306 station telecode "${trimmed}"

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/2956a68ce3aadc63. Report an issue: GitHub.