CVE-PUBLISH(1)

💖 NAME 💖

okay so bestie, gather round — cve-publish is the glow-up moment where you Publish a CNA container of a CVE record... 🎀

(and yes, this page lives in the cve publish Manual, iykyk ✨)

---

✨ SYNOPSIS ✨

cve publish [OPTIONS] CVE_ID

---

🦋 DESCRIPTION 🦋

So here's the vibe: you're taking a CNA container of a CVE record and publishing it for a CVE ID that's currently reserved (or rejected). That's it. That's the whole job. Periodt. 💅

But wait, there's lore 👑

• If the CVE is already published, this action doesn't yell at you — it just updates the CNA container in its record. Glow-up round two, babe.
• A published CVE can only be moved to the rejected state with an appropriate reject record (peep cve reject for that one).
• A published CVE cannot be moved back to the reserved state. Nope. No take-backs. That door is closed and locked and the key is at the bottom of the ocean. 😭

You can hand over the CNA container as a straight-up string, like:

cve publish CVE-2022-1234 -j '{"affected": [], "descriptions": [], "references": {}, ...}'

Or you can pass it in a file, which is honestly the more main-character move:

cve publish CVE-2022-1234 -f cve.json

Wanna know what properties a given CNA container of a CVE record actually requires? Go check the schema, bestie:

https://cveproject.github.io/cve-schema/schema/docs/

Now here's the tea ☕ — because the CVE Services API only expects the CNA container contents of the full CVE v5 record, the data you pass to this command can specify just the attributes defined by the cnaPublishedContainer or cnaRejectedContainer subschemas, and not the full schema record. So don't stress about the whole giant thing — bring the part that matters. 🫶

---

🔥 OPTIONS 🔥

• -j, --cve-json TEXT — the JSON body of the CVE record you wanna publish. straight into the command. no file needed, we're being efficient. 💖
• -f, --cve-json-file FILENAME — a file that's holding the JSON body of the CVE record you wanna publish. the file girlies stay winning. 📁✨
• --raw — Print response JSON. that's the raw tea, unfiltered. 🍓

---

🌸 little reminder, bestie: reserved or rejected IDs only for the first publish, and once it's published it can never go back to reserved. we don't un-publish in this house. 💀

---

mwah 💜 that was cve publish, from the cve publish Manual — version 1.8.0, dated 2025-09-29. go slay some CVE records, you've got this 👑🌈