Vulnerability Summary (CSV)
The four SAMPLE advisories flattened to one row each — the export a security review circulates, and the reference answer for any converter run against the Trivy, Grype or OSV reports here. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
advisory_id,alias,package,installed_version,fixed_version,severity,cvss_base_score,cwe
NOVUS-SAMPLE-2026-0001,SAMPLE-CVE-2026-0001,example-logger,3.4.1,3.5.0,HIGH,8.1,CWE-20
NOVUS-SAMPLE-2026-0002,SAMPLE-CVE-2026-0002,example-cache,0.9.2,0.9.5,CRITICAL,9.3,CWE-502
NOVUS-SAMPLE-2026-0003,SAMPLE-CVE-2026-0003,example-yaml-lite,1.1.7,1.2.0,MEDIUM,5.4,CWE-400
NOVUS-SAMPLE-2026-0004,SAMPLE-CVE-2026-0004,example-json-path,2.0.5,2.1.0,LOW,3.1,CWE-770
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CSV
- Columns
- 8
- Rows
- 4
- Delimiter
- ,
- Line Endings
- LF (documented, not RFC 4180 CRLF)
Testing contract
Reference control- Scenario
- Score a scanner-report-to-CSV converter against a known answer.
- Expected result
- Converted output matches these four rows exactly, including the CVSS base scores 8.1, 9.3, 5.4 and 3.1.
What is a .csv file?
CSV (Comma-Separated Values) is a plain-text tabular format where rows are lines and fields are separated by commas, with quoting rules for values that contain delimiters, quotes, or newlines. It has no formal type system and depends on encoding and dialect conventions. It is the most portable format for tabular data exchange.
How to use this file
Use an example CSV to test parsers against quoting and embedded-delimiter edge cases, header handling, encoding detection, and import pipelines into databases or spreadsheets.
How to use this file for testing
“Vulnerability Summary (CSV)” is a deterministic Novus Examples fixture for CSV parsing, Data import, Conversion testing. Clean and deliberately messy CSVs — quoted commas, embedded newlines, ragged rows, odd delimiters, and encodings.
Documented properties for this file: seed 51200 · 4 rows · 8 columns · LF (documented, not RFC 4180 CRLF). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import pandas as pd
df = pd.read_csv("vulnerability-summary.csv")
print(df.head())
print(df.dtypes)Related files
- csvLockfile Pin Summary (CSV)Declared range against resolved version for every fictional package pinned by the lockfiles in this category — the table a review needs to see which pins drifted from their manifest ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvSBOM Component Inventory (CSV)The same fictional component tree flattened to a spreadsheet-friendly CSV — name, version, licence, depth, purl and a SHA-256 prefix — for testing the export path SBOM tools offer alongside JSON. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvCoverage — Per-File Table (CSV)The same coverage as a flat table with a TOTAL row, for spreadsheets, trend charts and diffing two runs without an XML parser. The TOTAL row is the arithmetic sum of the four file rows, so it doubles as a checksum on any tool that regenerates it. Every file in this group describes the same four-file source tree and reports 127/140 lines, 17/24 branch outcomes and 18/20 functions, so a converter can be diffed against a known answer.
- csvTest Case Matrix — Twelve Documented Cases (CSV)Twelve test cases with level, priority, the requirement each covers, preconditions, steps and expected result — the table a test-management import expects. Eleven of the twelve are automated, and the requirement column joins this file to the traceability matrix next to it.
- graphmlDependency Graph (GraphML)The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range — the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvSLSA Build Level Matrix (CSV)How the nine fictional dependencies distribute across SLSA build levels, with the policy outcome for each band — the table that turns the VSA's dependencyLevels object into something reviewable. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.