News
Introducing patch2vuln v1.0: Streamlining Vulnerability Advisory Creation from Git Patches

Introducing patch2vuln v1.0: Streamlining Vulnerability Advisory Creation from Git Patches

September 18, 2026

 #GCVE#GNA#AI#Automation#BCP-05

When a security vulnerability is identified and patched in an open-source project, security analysts face a meticulous task: taking code-level fixes (git patches or pull requests) and translating them into comprehensive, standardized security advisories.

Constructing a complete advisory requires determining:

  • A clear title and detailed vulnerability description.
  • Appropriate CWE (Common Weakness Enumeration) classifications.
  • Relevant CAPEC (Common Attack Pattern Enumeration and Classification) mappings.
  • Accurate CVSS v4.0 vector calculations.
  • Affected products, version ranges, remediation steps, and researcher credits.

To accelerate this process while keeping analysts in control, we are glad to announce the initial release of patch2vuln (v1.0) under the GCVE Lab initiative.

What is patch2vuln?

patch2vuln is an open-source command-line tool designed to assist security analysts, product security incident response teams (PSIRTs), and GCVE/CVE Numbering Authorities (GNAs/CNAs).

Given a raw git patch (from a local file, standard input, or a direct commit URL), patch2vuln orchestrates a locally hosted Large Language Model (LLM) via Ollama to analyze the commit diff and generate a fully compliant CVE Record Format 5.2 JSON draft advisory.

+------------------+     +----------------------------------+     +------------------------+
|   INPUT PATCH    | --> |    PATCH2VULN PIPELINE           | --> | OUTPUT ADVISORY RECORD |
| (Local/URL/Diff) |     | Local LLM + Deterministic Math   |     | CVE Record Format 5.2  |
+------------------+     +----------------------------------+     +------------------------+

End-to-End Pipeline in a Single Command

One of the key design goals of patch2vuln is extreme operational efficiency. The entire pipeline—from patch ingestion to local AI analysis, CVSS calculation, schema validation, and BCP-05 enrichment—can be executed with a single command:

python3 patch2vuln.py \
  --gcve-id gcve-1-2026-20206 \
  --vendor misp \
  --product misp \
  https://github.com/MISP/misp/commit/382188d2f.patch

Step-by-Step Breakdown of the Pipeline

Here is how patch2vuln processes a git patch step-by-step:

1. Ingestion & Preprocessing

patch2vuln accepts patch inputs from HTTP/HTTPS URLs (e.g., GitHub .patch links), local files, or stdin. It calculates an immutable patchSha256 hash of the entire patch to ensure strict provenance and tracking.

2. Local AI-Assisted Analysis (Ollama Integration)

The patch context is sent to a locally hosted LLM via Ollama (using models such as qwen2.5-coder or custom local weights). Running locally guarantees that sensitive patch diffs or pre-disclosure fixes never leave your infrastructure.

The model generates:

  • Vulnerability Title & Description: Technical summarization of the root cause and impact.
  • CWE & CAPEC Mappings: Identification of weak software patterns and attack vectors.
  • CVSS v4.0 Vector: A proposed vector string (e.g., CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/...).
  • Affected Versions & Remediation Summaries: Extracted from commit logs and diff contexts.
  • Vulnerability Credits: Automatic parsing of commit authors and acknowledgement strings.

3. Pydantic Structured Output Validation

To eliminate arbitrary model hallucinations and unformatted responses, all LLM outputs are enforced and validated through strict Pydantic data schemas.

4. Deterministic CVSS v4.0 Score Calculation

Large Language Models are notoriously unreliable at performing numeric arithmetic. Rather than trusting an LLM-generated score, patch2vuln extracts the model’s proposed CVSS v4.0 vector string and calculates the exact numeric metric locally using pure, deterministic mathematical logic.

5. Metadata Enrichment & Standardized Provenance

patch2vuln automatically enriches the generated advisory with official GCVE Best Current Practice standards (see references below):

  • CVE Record Format 5.2 JSON: Emits standard JSON structure compatible with global vulnerability databases.
  • GCVE BCP-05-X-01 (AI Assistance): Standardized annotations denoting the role of AI in record drafting.
  • GCVE BCP-05-X-02 (Patch-to-Vulnerability Provenance): Embeds an x_patch2vuln extension recording source patch SHA-256, model configuration, assumptions, rationales, and explicit draft: true status.

Human-in-the-Loop Philosophy

It is important to emphasize that patch2vuln is built as an analyst assistant, not an autonomous publisher.

A patch provides strong technical evidence, but it rarely contains full real-world scope or business context. patch2vuln produces a structured draft record (draft: true), giving analysts a ~90% complete head start while leaving final review, verification, and publication decisions in human hands.

Alignment with GCVE Best Current Practices (BCPs)

The output structure and metadata handling in patch2vuln adhere strictly to the community standards established in the GCVE Best Current Practice (BCP) Directory. Key BCP references implemented by patch2vuln include:

To explore all published BCP standards and extensions, visit the full GCVE BCP Overview.

Sample GCVE record with the GCVE extension: GCVE-1-2026-20206.

Get Started Today

patch2vuln is available now on GitHub.

We welcome feedback, bug reports, and contributions from the community as we continue to refine automated vulnerability tooling within the GCVE ecosystem.

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference