---
id: csaf-tool
version: "0.3.2"
license: MIT
license_treatment: permissive
maintenance: dormant
---

# csaf-tool — CSAF generator and analyser

License: permissive · Maintenance: dormant · Downloads: 77.6K/mo

## What it is and what it does

CSAF-Tool is a command-line utility and Python library for working with CSAF 2.0 documents—the Common Security Advisory Framework standard for publishing structured vulnerability information. It reads product and vulnerability data from CSV files and generates a compliant CSAF JSON document that includes a product tree, vulnerability details, and remediation status. It can also parse and display an existing CSAF document in human-readable table format using the rich library.

The tool is designed for security teams and vendors who need to publish standardized vulnerability advisories. It depends on packageurl-python for package identification and rich for formatted terminal output. Development is dormant as of mid-2024, so it is suitable for stable, straightforward CSAF generation workflows but not for projects requiring active maintenance or new features.

Use it for:

- Generate a CSAF advisory document from a CSV list of products and their known vulnerabilities
- Parse and display an existing CSAF JSON file in a formatted table for review
- Integrate CSAF generation into a security advisory pipeline using the package as a library
- Publish vendor security advisories in the standardized CSAF format for compliance or distribution

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates and analyzes CSAF 2.0 documents, which describe product vulnerabilities and their remediation status in a standardized format.

Yes, if you need to generate or analyze CSAF 2.0 documents and accept dormant maintenance. The low install friction, permissive license, and zero known vulnerabilities make it safe to use. However, do not expect bug fixes or new features—evaluate whether the current feature set and stability meet your long-term needs before adopting it in a critical workflow.

## Install

pip install csaf-tool
uv add csaf-tool
poetry add csaf-tool

## Installing csaf-tool

Before you install: Low install friction with only two runtime dependencies. Maintenance is dormant—last commit was 2024-10-16, over 793 days ago—so expect no active bug fixes or feature updates.

License in practice: MIT license is permissive, allowing commercial and private use with minimal restrictions.

Quickstart:

pip install csaf-tool

csaf-tool --generate --product products.csv --vulnerabilities vulns.csv --output-file advisory.json --config csaf.ini

Requires Python 3.7 or later. CSV input files must follow the documented schema (product,vendor,release and product,release,id,description,status,comment headers).

Verify before relying:

- Whether the tool validates CSAF documents against the official CSAF 2.0 schema
- Support for CSAF formats beyond 2.0 or backward compatibility with earlier versions
- Whether programmatic library usage is documented or tested

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: dormant
- Downloads: 77.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

CSAF document generation, vulnerability advisory format, product security advisories, CSAF 2.0 parser, VEX vulnerability exchange, security advisory tool, security-advisory, csaf-vex

[View on SkillFed](https://skillfed.io/packages/csaf-tool) · [View on PyPI](https://pypi.org/project/csaf-tool/)