lib4vex

library0.2.3pypypi✓ verified 80d ago

VEX (Vulnerability Exploitability eXchange) generator and consumer library supporting CSAF, CycloneDX, and OpenVEX formats. Current version 0.2.3, requires Python >=3.7. The library allows creating, parsing, and validating VEX documents in multiple formats. Release cadence is irregular, with updates focused on bug fixes and format compatibility.

serialization data auth-security

pip install lib4vex

github ↗package ↗

INSTALL

IMPORT

SIG · LIB4VEX

lib4vex

serializationpythonv0.2.3

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

load

✓ import lib4vex

✗ from lib4vex import load

Generate a CSAF VEX document and print JSON; loading example commented out.

from lib4vex import load from lib4vex import generate # Create a VEX document (e.g., CSAF format) vex = generate('csaf') vex.author = 'me' vex.product = 'myapp' vex.version = '1.0.0' # Add a vulnerability vex.add_vulnerability(vulnerability_id='CVE-2024-12345', status='not_affected', impact_statement='Not applicable') # Output JSON print(vex.json()) # Load a VEX document from file # with open('vex.json', 'r') as f: # loaded_vex = load(f.read()) # print(loaded_vex.format())

Debug

Known issues

gotchaThe version field in OpenVEX documents must be an integer, not a string. Prior to v0.2.3, using a string version would cause validation errors.

fix

Ensure version is an integer when generating OpenVEX documents.

affects: <0.2.3

deprecatedAutomatic detection of VEX document type was introduced in v0.2.0. Older versions required manual specification of format.

fix

Upgrade to >=0.2.0 and use load() for auto-detection.

affects: <0.2.0

gotchaPartial product names (e.g., missing namespace) may cause parsing errors in SPDX documents. This was fixed in v0.2.1.

fix

Ensure product names are fully qualified or upgrade to latest version.

affects: <0.2.1

breakingThe API for adding vulnerabilities changed between v0.1.0 and v0.2.0. Methods like add_vulnerability signature may differ.

fix

Refer to documentation for current method signatures; upgrade to latest version.

affects: 0.1.0 to 0.2.0

Upgrade

Version history

0.2.3latest on PyPI · released Mar 9, 2026

Audit

Dependencies

No dependency data recorded yet.

Agent activity

24 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/anthonyharrison/lib4vex ↗

packagehttps://pypi.org/project/lib4vex/ ↗