Osv Vulnerability Scraper

OSV Vulnerability Scraper: Open Source Vulnerabilities by Package

This tool reads package vulnerability records and writes one clean row per vulnerability. Pick a package, an identifier, or a batch of packages, set your item cap, and export your data as JSON, CSV, or Excel directly from the Apify dataset.

Use cases

• Dependency review: provide a package name, ecosystem, and version to collect known vulnerabilities.
• Advisory lookup: paste an advisory identifier to keep summaries, aliases, and severity vectors.
• Batch audit: send several packages in a single query batch and hydrate each record.
• Ticket export: cap your run and drop the dataset straight into an issue tracker or spreadsheet.

What data does this tool extract?

Three flexible modes let you target exactly what you need:

• package_vulns: Query vulnerabilities by ecosystem, package name, and optional version, automatically following pagination tokens.
• vuln_details: Retrieve specific vulnerability records by identifier.
• batch_audit: Run batch queries and automatically pull full details for every matched identifier.

Runs pause briefly between calls to keep requests smooth, and duplicate identifiers within the same run are automatically filtered out. Failed calls generate clear error records instead of stopping your workflow.

Input

Parameter	Type	Default	Description
mode	string	package_vulns	Choose between package query, vulnerability identifier lookup, or batch audit.
packages	array	PyPI jinja2 2.4.1	Target packages with ecosystem, name, and optional version.
vulnIds	array	GHSA-462w-v97r-4m45	Specific vulnerability identifiers to look up.
maxItems	integer	100	Maximum vulnerability rows to save (minimum 1, maximum 1000).
requestDelaySecs	number	1	Pause duration between requests.
userAgent	string	BigiByteActorResearch/1.0	Custom client identification sent with requests.
timeoutSecs	integer	300	Maximum run duration in seconds (up to 3600).
requestTimeoutSecs	integer	30	Timeout per individual request.
proxyConfiguration	object	Disabled	Optional proxy settings.

Example input

{
  "mode": "package_vulns",
  "packages": [
    {"ecosystem": "PyPI", "name": "jinja2", "version": "2.4.1"}
  ],
  "maxItems": 100,
  "requestDelaySecs": 1,
  "userAgent": "B2BLeadGenerationResearch/1.0",
  "timeoutSecs": 300,
  "requestTimeoutSecs": 30,
  "proxyConfiguration": {"useApifyProxy": false}
}

Output example

{
  "id": "GHSA-462w-v97r-4m45",
  "summary": "Jinja2 sandbox escape via string formatting",
  "details": "In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.",
  "aliases": ["CVE-2019-10906", "PYSEC-2019-217"],
  "published": "2019-04-10T14:30:24Z",
  "modified": "2024-09-24T21:03:59.802687Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "severityKind": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
    }
  ],
  "affected_package": "jinja2",
  "affected_ecosystem": "PyPI",
  "references": [
    {
      "type": "ADVISORY",
      "referenceKind": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10906"
    }
  ],
  "queried_package": "jinja2@2.4.1",
  "scraped_at": "2026-10-12T00:00:00+00:00"
}

---

FAQ

Can I export CSV? Yes. Apify allows you to export your dataset as JSON, CSV, or Excel instantly.

What happens if a vulnerability identifier cannot be found? You receive a single error row containing the status and message, while successful records continue to process normally.

How many vulnerabilities can a single run save? maxItems defaults to 100 and can be adjusted up to 1000.

---

Is web scraping legal?

This actor collects publicly available vulnerability information without bypassing access controls or requiring credentials. However, how you use the collected data matters:

• Personal data: If results contain personal information, ensure compliance with relevant privacy regulations like GDPR or CCPA.
• Copyright: Avoid republishing copyrighted text or descriptions without permission.
• Terms of use: Respect rate limits and usage guidelines.
• Legal advice: This overview is for informational purposes and does not constitute legal advice. For more details, read Apify's guide on Is web scraping legal?