diff --git a/commit-stream.js b/commit-stream.js
index 2bf713a..0f034b0 100644
--- a/commit-stream.js
+++ b/commit-stream.js
@@ -46,6 +46,8 @@ export default function commitStream (ghUser, ghProject) {
         commit.reviewers = []
       }
       commit.reviewers.push({ name: m[1], email: m[2] })
+    } else if ((m = line.match(/\bCVE-ID:\s+(CVE-\d{4}-\d{5})\b/)) !== null) {
+      commit.cveId = m[1];
     } else if ((m = line.match(/^\s+PR(?:[- ]?URL)?:?\s*(.+)\s*$/) || line.match(/\(#(\d+)\)$/)) !== null) {
       commit.prUrl = m[1]
       if (
diff --git a/test.js b/test.js
index f88ec4f..ef05d56 100644
--- a/test.js
+++ b/test.js
@@ -224,3 +224,22 @@ test('current commit log with ghUser and ghRepo passed', function (t) {
     }, 'got correct pr url for green-button merge')
   })
 })
+
+test('cve id', function (t) {
+  gitToList(t, 'git log', 'rvagg', 'commit-stream', function (err, list) {
+    t.error(err, 'no error')
+
+    t.ok(list && list.length > 1, 'got a list')
+
+    t.deepEqual(list[list.length - 30], {
+      sha: 'de55c4c81dfb6cf13e5e2ae24ae88c9be4f5b598',
+      authors: [
+        { name: 'RafaelGSS', email: 'rafael.nunu@hotmail.com' }
+      ],
+      authorDate: 'Fri Nov 22 00:19:29 2024 -0300',
+      author: { name: 'RafaelGSS', email: 'rafael.nunu@hotmail.com' },
+      summary: 'feat: add cveId support',
+      cveId: 'CVE-2024-12345'
+    }, 'got correct pr url for green-button merge')
+  })
+})