Skip to content

OSV API exposes syntactically incorrect CVSSv4 scores #5835

Description

@Elkasitu

Describe the bug
A number of OSV records from multiple ecosystems provide a CVSSv4 vector with a trailing slash which is not valid syntax per the CVSSv4 schema and any schema-compliant parsing library will trip up when processing such CVSSv4 vectors.

Some examples:
https://api.osv.dev/v1/vulns/GHSA-g357-x5c3-c72p
https://api.osv.dev/v1/vulns/GHSA-9p7c-v5x3-rfx8
https://api.osv.dev/v1/vulns/GHSA-78fc-9688-w8xw

To Reproduce
Steps to reproduce the behaviour:

  1. Go to any of the above links
  2. Copy the CVSSv4 vector
  3. Pass it to any schema-compliant CVSS parsing library
  4. Library will raise an error

Expected behaviour
Error is not raised, CVSSv4 vector complies with the schema.

Screenshots
N/A

Additional context
N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions