feat: CVE conversion triager tool by jess-lowe · Pull Request #4916 · google/osv.dev

jess-lowe · 2026-02-26T00:01:52Z

Quite often do we need to compare multiple records of one CVE record to triage conversion issues, so this tool will allow us to compare three versions at a time.

You can select from the following record locations:

the og cve5 record
the og NVD record
the nvd-converted osv record in prod
the nvd-conversion metrics notes in prod
the nvd-converted osv record in test
the nvd-conversion metrics notes in test
the cve5-converted osv record in prod
the cve5-conversion metrics notes in prod
the cve5-converted osv record in test
the cve5-conversion metrics notes in test
the combined output in prod
the combined output in test
prod api
test api

It currently exists at /triage, and utilises a proxy mechanism to load the records, but not as a path (as to prevent accessing unrelated parts of the bucket)

In the future could add a tool for an LLM to help triage what the actual problem is, but that's for another day

This change introduces a new triage page to visualize and compare CVE conversion data across different stages and environments. - Added `gcp/website/triage_handlers.py` to handle triage requests and proxy GCS file access. - Registered the new blueprint in `gcp/website/main.py`. - Created the frontend template `gcp/website/frontend3/src/templates/triage.html` with a 3-column layout. - Implemented frontend logic in `gcp/website/frontend3/src/triage.js` to fetch and display JSON data from GCS or the API. - Added styles in `gcp/website/frontend3/src/triage.scss`. - Updated Webpack configuration to include the new triage entry point. - Verified with unit tests and frontend screenshots. Co-authored-by: jess-lowe <86962800+jess-lowe@users.noreply.github.com>

…44985313989 feat: Add CVE conversion triage page

…44985313989 fix: improve patching issues with triage tool

another-rex · 2026-02-27T05:02:31Z

gcp/website/triage_handlers.py

+  try:
+    response = requests.get(url, timeout=10)
+    response.raise_for_status()
+    return response.text, 200, {'Content-Type': 'application/json'}


For running locally, the output is handled as JSON and escaped in the frontend.

gcp/website/frontend3/src/templates/triage.html

jess-lowe · 2026-02-26T00:09:44Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a new CVE conversion triager tool, which is a great addition for comparing different CVE record versions. The implementation includes a new frontend page with its corresponding JavaScript and SCSS, and a backend proxy handler in Python. The overall structure is well-thought-out. I've included several suggestions to enhance code quality, maintainability, and adherence to best practices in both the frontend and backend code.

gcp/website/frontend3/src/triage.js

gcp/website/frontend3/src/triage.scss

gcp/website/triage_handlers.py

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

another-rex · 2026-02-27T04:55:53Z

gcp/website/triage_handlers.py

+  url = None
+  if source == 'cve':
+    # Construct GitHub raw URL for CVE data
+    match = re.match(_CVE_ID_REGEX, vuln_id)


I see match groups below this, but the regex doesn't have capture groups?

another-rex · 2026-02-27T05:00:40Z

gcp/website/frontend3/src/triage.js

+    return div.innerHTML;
+  }
+
+  function syntaxHighlight(json) {


Probably should credit this codepen: https://codepen.io/absolutedevelopment/pen/EpwVzN

another-rex · 2026-02-27T05:01:56Z

gcp/website/frontend3/src/triage.js

+    },
+  };
+
+  function escapeHtml(text) {


another-rex · 2026-02-27T05:02:31Z

gcp/website/triage_handlers.py

+  try:
+    response = requests.get(url, timeout=10)
+    response.raise_for_status()
+    return response.text, 200, {'Content-Type': 'application/json'}


For running locally, the output is handled as JSON and escaped in the frontend.

google-labs-jules bot and others added 10 commits February 24, 2026 02:55

Merge pull request #5 from jess-lowe/cve-conversion-triager-109754468…

95d87b5

…44985313989 feat: Add CVE conversion triage page

Progress

48a23bd

fix using path proxy and instead use source and id

2cf4f71

fix overflow problem

82c8f83

put title and vuln search inline

1f46199

Merge pull request #6 from jess-lowe/cve-conversion-triager-109754468…

f95adc1

…44985313989 fix: improve patching issues with triage tool

jess-lowe changed the title ~~CVE conversion triager tool~~ feat CVE conversion triager tool Feb 26, 2026

jess-lowe changed the title ~~feat CVE conversion triager tool~~ feat: CVE conversion triager tool Feb 26, 2026

github-advanced-security bot found potential problems Feb 26, 2026

View reviewed changes

jess-lowe commented Feb 26, 2026

View reviewed changes

gcp/website/frontend3/src/templates/triage.html Outdated Show resolved Hide resolved

gcp/website/frontend3/src/templates/triage.html Outdated Show resolved Hide resolved

jess-lowe added 2 commits February 26, 2026 11:06

Update gcp/website/frontend3/src/templates/triage.html

71067df

Update gcp/website/frontend3/src/templates/triage.html

49378ff

gemini-code-assist bot reviewed Feb 26, 2026

View reviewed changes

jess-lowe and others added 8 commits February 26, 2026 11:11

Update gcp/website/frontend3/src/triage.scss

f688808

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Update gcp/website/frontend3/src/triage.js

2560c7a

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Update gcp/website/frontend3/src/triage.js

2e752b9

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

address nits

2fac31f

some improvements to reallly hopefully prevent xss

968d549

fix lint

5af65c3

Make sure this is only run locally for now

231e3dd

lint

05a086d

another-rex approved these changes Feb 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: CVE conversion triager tool#4916

feat: CVE conversion triager tool#4916
jess-lowe wants to merge 20 commits intogoogle:masterfrom
jess-lowe:cve-conversion-triager-tool

jess-lowe commented Feb 26, 2026 •

edited

Loading

Uh oh!

Check warning

another-rex Feb 27, 2026

Uh oh!

Uh oh!

Uh oh!

jess-lowe commented Feb 26, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

another-rex Feb 27, 2026

Uh oh!

another-rex Feb 27, 2026

Uh oh!

another-rex Feb 27, 2026

Uh oh!

another-rex Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jess-lowe commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Check warning

Uh oh!

another-rex Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jess-lowe commented Feb 26, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

another-rex Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

another-rex Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

another-rex Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

another-rex Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jess-lowe commented Feb 26, 2026 •

edited

Loading