See llms.txt for all machine-readable content.

Back to Templates

Triage dependency CVEs with OSV.dev, CISA KEV, Claude and Gmail

Created by

Created by: Ellen Ivanovic || kellenjay
Ellen Ivanovic

Last update

Last update a day ago

Categories

Quick overview

This workflow runs daily to check your listed dependencies against OSV.dev vulnerabilities and CISA’s Known Exploited Vulnerabilities catalog, uses Anthropic Claude to assess whether each issue applies to your stack and draft fixes, logs all findings to Google Sheets, and emails only high-risk items via Gmail.

How it works

  1. Runs on a daily schedule (or manually for testing) and loads the dependency inventory and versions you want to monitor.
  2. Fetches the CISA Known Exploited Vulnerabilities (KEV) feed and submits the dependency list to the OSV.dev batch query API.
  3. Expands OSV results into one item per vulnerability and retrieves full details for each advisory from OSV.dev.
  4. Deduplicates vulnerabilities already reported in previous runs, flags advisories whose CVEs appear in the CISA KEV list, and collects a capped list of new findings.
  5. Sends the findings and your stack description to Anthropic Claude to judge whether each vulnerability likely applies and to draft a concrete upgrade/configuration fix.
  6. Appends every assessed finding to a Google Sheets log and marks the vulnerability IDs as reported so they are not re-sent on future days.
  7. Filters to only actively exploited items or critical/high findings that may apply, builds an HTML digest, and sends the alert email through Gmail.

Setup

  1. Add credentials for Anthropic (Claude API), Google Sheets, and Gmail in n8n.
  2. Update the dependency list (ecosystem, package name, and exact installed version) and the stack description used for Claude’s applicability assessment.
  3. Select the target Google Sheets document and sheet, and ensure the first row headers match: date,package,version,id,cve,severity,exploited,applies,priority,why,fix,url.
  4. Set the recipient email address and the Google Sheet URL used in the email template.
  5. Optional: adjust the daily schedule time and the “high-risk” filtering rules that decide what gets emailed.

Requirements

  • An Anthropic API key (or any LLM) for the assessment step
  • Google Sheets + Gmail (or another email) credentials
  • A Google Sheet to log findings
  • Your dependency list (names + exact versions)

Customization

  • Swap Gmail for Slack, Discord or Telegram alerts
  • Change the daily schedule, or the rule in “High-risk only” that decides what emails you
  • Add GitHub Security Advisories alongside OSV + CISA
  • Watch several projects by expanding the inventory list

Additional info

Production-tested — I run this on my own apps daily. It uses only free, no-key data sources (OSV.dev + CISA KEV) plus any LLM for the risk assessment. Human-in-the-loop by design: the model only drafts fixes, nothing is changed or deployed automatically. Two-tier output (log everything to Sheets, email only high-risk) keeps it from becoming alert spam.