> For the complete documentation index, see [llms.txt](https://doc.duaer.com/zh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.duaer.com/zh/getting-started/osv.md).

# 在 Duaer 里查OSV 开源漏洞

在 Duaer 里：查询 OSV 中开源软件包或某版本的已知漏洞，覆盖 npm、PyPI、Go、Maven、crates.io 等生态，含严重程度与修复版本。一次成功查询用 1 额度。
## 能拿到什么

Duaer 数据市场里的「OSV 开源漏洞」：查询 OSV 中开源软件包或某版本的已知漏洞，覆盖 npm、PyPI、Go、Maven、crates.io 等生态，含严重程度与修复版本。查到结果时用 1 额度，结果交给数字组织的下一个节点。

从节点创建器选 Duaer 数据 → OSV 开源漏洞，或打开 [数据市场](/zh/getting-started/data-market.md)。相关：[NVD 漏洞库](/zh/getting-started/nvd.md)、[npm 软件包](/zh/getting-started/npm.md)。

## 适合做什么

- 检查某依赖的某个版本是否有已知漏洞。
- 查看漏洞影响的版本与修复版本。

## 在画布里检索

1. 打开节点创建器，选 Duaer 数据 → OSV vulnerabilities。
2. 填 Package（如 lodash）；Ecosystem（如 npm）、Version 可选。或只填 Vulnerability ID。
3. Limit 默认 10，最大 20。执行。

查到结果才扣 1 额度；没有结果、输入有误或上游失败都不扣。

## 用 API 调用

- GET https://api.duaer.com/v1/data/osv?package=lodash&version=4.17.15
- Authorization: Bearer <Duaer key>

下方是与数据市场「复制技能」相同的英文技能，含参数、示例与返回字段。

## 调用技能（英文）

与数据市场「复制技能」一致。

```
---
name: duaer-osv
description: >-
  Duaer OSV vulnerabilities. Known vulnerabilities in an open-source package or version from OSV, across npm, PyPI, Go, Maven, crates.io, and more, with severity and fixed versions.
  One successful search uses 1 Duaer credit.
---

# Duaer OSV vulnerabilities

Duaer OSV vulnerabilities queries the OSV database that aggregates GitHub advisories, PyPA, Go, RustSec, and other feeds. Give a package, optionally a version, or one vulnerability id.

## When to use

- Check whether a dependency version has known vulnerabilities.
- Find the version that fixes an advisory.

## When not to use

- CVSS details for one CVE. Use https://skills.duaer.com/nvd.md.
- Vulnerabilities attacked in the wild. Use https://skills.duaer.com/cisa-kev.md.

## Call

`GET https://api.duaer.com/v1/data/osv?package=lodash&version=4.17.15`

Header: `Authorization: Bearer <Duaer key>`

Use an account key or a model API key.

Get a Duaer key: https://skills.duaer.com/keys.md

## Parameters

Provide `package`, or `id`.

- `package` — Package name, such as lodash or requests.
- `ecosystem` — Optional. npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Pub, Hex, Hackage, SwiftURL, Debian, Alpine, or Ubuntu. Default npm.
- `version` — Optional. Only vulnerabilities that affect this version.
- `id` — Optional. One entry such as GHSA-29mw-wpgm-hmr9 or CVE-2021-44228.
- `limit` — Optional. Rows to return, from 1 to 20. Default 10.

## Examples

- `GET https://api.duaer.com/v1/data/osv?package=lodash&version=4.17.15` — vulnerabilities in lodash 4.17.15.
- `GET https://api.duaer.com/v1/data/osv?package=django&ecosystem=PyPI&limit=5` — recent Django advisories.

## Result

The response is `{ "items": [...] }`. Each item has `source`, `title`, `url`, and `summary`, plus:

- `vulnerabilityId`, `aliases` — OSV id and CVE or GHSA aliases.
- `severity`, `cvss`, `cwe` — severity label, CVSS vector, and weakness ids.
- `fixedVersions` — versions that fix it for this package.
- `published`, `modified` — dates.

Rows are newest first.

Fields without a value are left out.

## Credits

A search that returns at least one row uses 1 credit.
An empty search, a search that finds nothing, or a failed search uses 0.
Wrong input returns 400 with a message and uses 0.
No remaining credits returns 402 and does not search.
A missing key returns 401.

## Related

- https://skills.duaer.com/nvd.md — Duaer NVD CVE records
- https://skills.duaer.com/npm.md — Duaer npm packages

```
## Questions

### Duaer 的OSV 开源漏洞检索扣多少额度？

查到结果时扣 1 额度；没有结果或出错不扣。

### Duaer OSV 开源漏洞需要填版本吗？

不必。在 Duaer 里不填 Version 会列出该包的全部已知漏洞；填了只返回影响该版本的漏洞。

## 相关

- [在 Duaer 里查NVD 漏洞库](https://doc.duaer.com/zh/getting-started/nvd.md)
- [在 Duaer 里查npm 软件包](https://doc.duaer.com/zh/getting-started/npm.md)