examples/vex_dependency.json

{
 "model": "jue-latest",
 "state": {
  "advisory": {
   "id": "GHSA-example",
   "package": "npm:lodash",
   "vulnerable_range": "<4.17.21",
   "patched": "4.17.21",
   "vulnerable_function": "lodash.template"
  },
  "sbom_component": {
   "name": "lodash",
   "version": "4.17.15",
   "scope": "runtime"
  },
  "reachability": "Static call graph: application imports lodash.merge and lodash.get only; no call path reaches lodash.template."
 },
 "questions": {
  "version_affected": {
   "type": "noul",
   "instructions": "The installed version is inside the vulnerable range."
  },
  "vex_status": {
   "type": "choice",
   "instructions": "OpenVEX status for this product.",
   "criteria": {
    "affected": "affected",
    "not_affected": "not_affected (vulnerable code not reachable)",
    "fixed": "fixed",
    "under_investigation": "under_investigation"
   }
  }
 }
}