The OSV Schema is an OpenSSF JSON format for describing open-source vulnerabilities, with precise affected-version ranges expressed against package ecosystems. It gives vulnerability data a machine-readable shape that can be matched against a dependency list without heuristics.
OSV Schema
The OSV Schema exists because vulnerability data was, for years, prose. An advisory would say a package was affected in “versions before 2.4.1, and some 3.x” and every scanner would interpret that slightly differently. OSV defines a JSON format where the affected ranges are expressed precisely, per ecosystem, against the package naming that ecosystem actually uses.
- Precise affected ranges - Introduced and fixed events per range, rather than a human-readable version sentence.
- Ecosystem-aware - npm, PyPI, Go, Maven, crates.io, Linux distributions and more, each with its own naming and version-ordering rules.
- Aliases - Explicit linking of CVE, GHSA and ecosystem-specific identifiers for the same underlying flaw.
- JSON Schema - Machine-checkable, and consumed by a growing set of scanners and databases.
For API providers the relevance is direct: an API’s attack surface includes its dependency tree, and OSV is what makes “is this estate affected” a query rather than a research project. It sits with SPDX — the bill of materials you match against — and with SLSA and in-toto, which describe how the artifact was built. Read together, they are the machine-readable answer to the question every security review asks by hand.
Open source tools that implement this standard
Harvested from this standard's own governing organisation, with the license read from each repository rather than assumed. The role is what the tool does to the specification, from the shared vocabulary — so an agent holding one of these documents can resolve straight from a goal to a tool.
| Tool | Role | License | What it does |
|---|---|---|---|
| Grype | scans |
Apache-2.0 | Scans container images, filesystems and SBOMs for known vulnerabilities, reading OSV and other vulnerability sources. |
| OSV-Scanner | scans |
Apache-2.0 | Scans lockfiles, SBOMs, container images and directories against the OSV database, and reports vulnerabilities in the OSV schema. |
| OSV.dev | stores |
Apache-2.0 | The vulnerability database and API behind the OSV schema — aggregates advisories across ecosystems and serves them in one consi... |
| OSV-SCALIBR | scans |
Apache-2.0 | An extensible library for extracting software inventory from filesystems and images, and the extraction engine underneath OSV-S... |
| OSV Schema | authors |
Apache-2.0 | The JSON schema describing open-source vulnerabilities in a way that is precise about which versions are affected, across every... |
