cvss-score-extraction

name	cvss-score-extraction
description	Extract CVSS scores from vulnerability data sources with proper fallback handling across NVD, GHSA, and RedHat sources.

CVSS Score Extraction

Overview

CVSS (Common Vulnerability Scoring System) scores may come from multiple sources in Trivy output. Implement priority-based extraction with fallbacks.

Trivy CVSS Structure

{
  "CVSS": {
    "nvd": { "V3Score": 9.8, "V3Vector": "..." },
    "ghsa": { "V3Score": 8.1, "V3Vector": "..." },
    "redhat": { "V3Score": 7.5, "V3Vector": "..." }
  }
}

Extraction Priority

1. NVD (nvd.V3Score) — preferred authoritative source
2. GHSA (ghsa.V3Score) — GitHub Security Advisory
3. RedHat (redhat.V3Score) — Red Hat security data
4. Fall back to empty string or "N/A" if no score available

Python Implementation

def extract_cvss_score(cvss_data):
    """Extract CVSS v3 score with source priority: NVD > GHSA > RedHat."""
    if not cvss_data:
        return ""
    for source in ["nvd", "ghsa", "redhat"]:
        source_data = cvss_data.get(source, {})
        score = source_data.get("V3Score")
        if score is not None:
            return score
    return ""