Machine-Actionability of Vulnerability Metadata in OSV: A Cross-Ecosystem Study of Remediation and Provenance

Open Source Vulnerabilities (OSV) provides a common machine-readable schema for vulnerability data across software package ecosystems, but a common schema does not necessarily imply uniform machine-actionability. We conduct a quantitative repository-mining study of the official OSV per-ecosystem exports for npm, PyPI, Maven, Go, NuGet, crates.io, RubyGems, and Packagist. After excluding withdrawn records and malware-linked identity components, the frozen snapshot contains 61,310 advisory-package units representing 49,174 unique advisories. Structured affected-software information is nearly universal, with at least 98.6% of units in every ecosystem containing an eligible range. In contrast, explicit standardized precise-fix coverage ranges from 74.9% to 98.3%, and standardized severity coverage from 45.2% to 98.2%. Advisory-source provenance is highly uneven across ecosystems and is particularly consequential for severity: the bias-corrected Cramér's V between home-database family and standardized severity is 0.732, compared with 0.444 for ecosystem. Source-aware models and a GHSA-only sensitivity analysis show that provenance explains a substantial part, but not all, of the observed heterogeneity. Publication-cohort patterns are non-monotonic and partly reflect changing source composition. The results show that OSV provides strong structural interoperability while retaining source-dependent differences in remediation and severity representation. Consequently, downstream consumers and empirical studies should treat provenance as first-class context and should not interpret missing standardized remediation metadata as evidence that no real-world fix exists.