Vulnerability Triage Report (Markdown)
The human-readable end of the pipeline: a triage report that records a decision and a reachability path for each of the four SAMPLE findings, matching the states asserted by the VEX documents here. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
# Vulnerability triage report — Orchard Gateway 4.2.0 (SAMPLE)
> Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Scan date: 2026-01-01 · Scanner: SAMPLE fixture · Findings: 4
| Advisory | Package | Installed | Fixed in | Severity | Decision |
| --- | --- | --- | --- | --- | --- |
| NOVUS-SAMPLE-2026-0001 | `example-logger` | 3.4.1 | 3.5.0 | High (8.1) | Upgrade now — blocks release |
| NOVUS-SAMPLE-2026-0002 | `example-cache` | 0.9.2 | 0.9.5 | Critical (9.3) | Not affected — vulnerable path not reachable |
| NOVUS-SAMPLE-2026-0003 | `example-yaml-lite` | 1.1.7 | 1.2.0 | Medium (5.4) | Fixed in next scheduled release |
| NOVUS-SAMPLE-2026-0004 | `example-json-path` | 2.0.5 | 2.1.0 | Low (3.1) | Accepted risk — tracked, expires 2026-04-01 |
## How the decisions were reached
### NOVUS-SAMPLE-2026-0001 — `example-logger` 3.4.1
- Vulnerable range: `<3.5.0`, fixed in `3.5.0`.
- Weakness class: CWE-20. CVSS v3.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (base 8.1).
- Reached through: `@orchard-example/router`, `@orchard-example/http-core`, `example-metrics`.
- Decision: Upgrade now — blocks release.
### NOVUS-SAMPLE-2026-0002 — `example-cache` 0.9.2
- Vulnerable range: `>=0.9.0 <0.9.5`, fixed in `0.9.5`.
- Weakness class: CWE-502. CVSS v3.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` (base 9.3).
- Reached through: `@orchard-example/gateway`.
- Decision: Not affected — vulnerable path not reachable.
### NOVUS-SAMPLE-2026-0003 — `example-yaml-lite` 1.1.7
- Vulnerable range: `<1.2.0`, fixed in `1.2.0`.
- Weakness class: CWE-400. CVSS v3.1 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` (base 5.4).
- Reached through: `example-cache`.
- Decision: Fixed in next scheduled release.
### NOVUS-SAMPLE-2026-0004 — `example-json-path` 2.0.5
- Vulnerable range: `<2.1.0`, fixed in `2.1.0`.
- Weakness class: CWE-770. CVSS v3.1 `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L` (base 3.1).
- Reached through: `@orchard-example/http-core`, `example-yaml-lite`.
- Decision: Accepted risk — tracked, expires 2026-04-01.
## Counts
| Severity | Findings |
| --- | --- |
| Critical | 1 |
| High | 1 |
| Medium | 1 |Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- Markdown
- Findings
- 4
- Decisions
- 4
- Tables
- 2
- Line Endings
- LF
Testing contract
Reference control- Scenario
- Check that a generated VEX document agrees with the written triage decision.
- Expected result
- Each decision in the table maps to the matching status in the OpenVEX file: affected, not_affected, fixed and under_investigation in the same order.
What is a .md file?
Markdown (MD) is a lightweight plain-text markup language that uses simple punctuation conventions to denote headings, lists, links, emphasis, and code. It is designed to be readable as-is and to convert cleanly to HTML. It is widely used for documentation, READMEs, and content authoring.
How to use this file
Use an example Markdown file to test parsers and renderers, verify GitHub-Flavored Markdown extensions like tables and fenced code, and exercise HTML-conversion pipelines.
How to use this file for testing
“Vulnerability Triage Report (Markdown)” is a deterministic Novus Examples fixture for Editor testing, Conversion testing. Text-based files you can open, edit, and download directly in the browser editor.
Documented properties for this file: seed 51200 · LF · Markdown. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Code examples
import markdown # pip install markdown
html = markdown.markdown(open("vulnerability-triage-report.md").read())
print(html[:200])Related files
- jsonCycloneDX 1.6 Application SBOM (JSON)A complete CycloneDX 1.6 SBOM in JSON for a fictional application and its nine dependencies, with purls, SHA-256 hashes, supplier records, external references and an explicit dependency graph. Every package, version, hash and licence is fictional — the tree describes nothing real.
- xmlCycloneDX 1.6 Application SBOM (XML)The same fictional CycloneDX 1.6 SBOM serialised as XML against the cyclonedx.org/schema/bom/1.6 namespace — the JSON twin of this file carries identical components and edges, so a converter can be diffed exactly. Every package, version, hash and licence is fictional — the tree describes nothing real.
- mmdDependency Graph (Mermaid Flowchart)The dependency graph as Mermaid, for embedding in Markdown documentation — labelled edges carry the declared range and a classDef highlights the two diamond joins. Every package, version, hash and licence is fictional — the tree describes nothing real.
- dotDependency Graph With Diamonds (Graphviz DOT)The same diamond graph as Graphviz DOT, with edge labels carrying the declared semver range and the two diamond joins filled — renderable to SVG and diffable against the JSON twin. Every package, version, hash and licence is fictional — the tree describes nothing real.
- mdProvenance Verification Runbook (Markdown)The five checks a verifier must perform against the attestation fixtures in this category, and the exact result each one should produce — including the two that are meant to fail. Every package, version, hash and licence is fictional — the tree describes nothing real.
- mdSBOM Format Crosswalk (CycloneDX to SPDX)The field-by-field map between the CycloneDX 1.6 and SPDX 2.3 documents in this category, plus the five invariants a correct conversion preserves and the three things it legitimately loses. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.