fix: Add required action_statement field

Author: ppkarwasz

src/conf/security/VEX.cyclonedx.xml

@@ -64,6 +64,10 @@
           </source>
         </reference>
       </references>
+      <recommendation>
+Check if untrusted user input is passed to the `StringSubstitutor` or `StringLookup` classes,
+and if so, upgrade to Apache Commons Lang 3.18.0 or later.
+      </recommendation>
       <analysis>
         <state>exploitable</state>
         <responses>

src/conf/security/generate_openvex.py

@@ -121,6 +121,13 @@ def to_openvex_statement(vuln: ET.Element, product: dict) -> dict:
     if detail:
         statement['status_notes'] = detail
 
+    remediation = _find_stripped_text(vuln, 'b:recommendation')
+    if remediation:
+        statement['action_statement'] = remediation
+    else:
+        if statement['status'] == 'affected':
+            raise ValueError("Affected vulnerabilities must have a <recommendation> element")
+
     _add_optional_date(analysis, 'b:firstIssued', statement, 'timestamp')
     _add_optional_date(analysis, 'b:lastUpdated', statement, 'last_updated')
 

src/conf/security/openvex.json

@@ -25,6 +25,7 @@
       },
       "status": "affected",
       "status_notes": "CVE-2025-48924 is exploitable in Apache Commons Text versions 1.5 and later, but only when all the following conditions are met:\n\n* The consuming project includes a vulnerable version of Commons Text on the classpath.\n  As of version `1.14.1`, Commons Text no longer references a vulnerable version of the `commons-lang3` library in its POM file.\n* Unvalidated or unsanitized user input is passed to the `StringSubstitutor` or `StringLookup` classes.\n* An interpolator lookup created via `StringLookupFactory.interpolatorLookup()` is used.\n\nIf these conditions are satisfied, an attacker may cause an infinite loop by submitting a specially crafted input such as `${const:...}`.",
+      "action_statement": "Check if untrusted user input is passed to the `StringSubstitutor` or `StringLookup` classes,\nand if so, upgrade to Apache Commons Lang 3.18.0 or later.",
       "timestamp": "2025-07-29T12:26:42Z",
       "last_updated": "2025-07-29T12:26:42Z"
     }