Introduction of OSV Schema for Open Source Vulnerability Management

On July 11, 2026, the Open Source Security Foundation (OSSF) published the OSV schema, a standardized format for describing vulnerabilities in open source packages. This initiative aims to unify various vulnerability databases, making it easier for users and researchers to access and manage vulnerability information. The schema supports JSON encoding and allows for backward-compatible changes, ensuring flexibility for database maintainers. Several databases, including GitHub Security Advisories and PyPA, have adopted this schema, enhancing the interoperability of vulnerability data. The OSV.dev platform offers an API for querying vulnerabilities and supports command-line tools for scanning software bill of materials (SBOMs) and container images. This development is expected to improve detection and remediation times for vulnerabilities across the open-source ecosystem. The OSV schema is open source and encourages feedback from the community to refine its implementation.

Key Points: • The OSV schema standardizes vulnerability reporting for open source software. • Adoption by major databases enhances data sharing and automation capabilities. • OSV.dev provides tools for querying vulnerabilities and scanning software.