diff --git a/pkgs/by-name/cs/csaf-tool/package.nix b/pkgs/by-name/cs/csaf-tool/package.nix
new file mode 100644
index 000000000000..7bf230eb5a7a
--- /dev/null
+++ b/pkgs/by-name/cs/csaf-tool/package.nix
@@ -0,0 +1,5 @@
+{
+  python3Packages,
+}:
+
+python3Packages.toPythonApplication python3Packages.csaf-tool
diff --git a/pkgs/development/python-modules/csaf-tool/default.nix b/pkgs/development/python-modules/csaf-tool/default.nix
new file mode 100644
index 000000000000..bfb547ea5e8f
--- /dev/null
+++ b/pkgs/development/python-modules/csaf-tool/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  packageurl-python,
+  pythonOlder,
+  rich,
+  setuptools,
+  versionCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "csaf-tool";
+  version = "0.3.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "anthonyharrison";
+    repo = "csaf";
+    tag = "${version}";
+    hash = "sha256-LR6r03z0nvvAQgFHaTWfukoJmLZ6SLPXfbp/G8N/HtM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    packageurl-python
+    rich
+  ];
+
+  # has not tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "csaf" ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+
+  meta = with lib; {
+    description = "CSAF generator and validator";
+    homepage = "https://github.com/anthonyharrison/csaf";
+    changelog = "https://github.com/anthonyharrison/csaf/releases/tag/${src.tag}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ teatwig ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5b9247f789bb..f4f1c9e53ab6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2946,6 +2946,8 @@ self: super: with self; {
 
   crytic-compile = callPackage ../development/python-modules/crytic-compile { };
 
+  csaf-tool = callPackage ../development/python-modules/csaf-tool { };
+
   cson = callPackage ../development/python-modules/cson { };
 
   csrmesh = callPackage ../development/python-modules/csrmesh { };