google / google/osv.dev

OSV API exposes syntactically incorrect CVSSv4 scores

Open Beginner friendly
#5,835 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
A number of OSV records from multiple ecosystems provide a CVSSv4 vector with a trailing slash which is not valid syntax per the CVSSv4 [schema](https://www.first.org/cvss/cvss-v4.0.json) and any schema-compliant parsing library will trip up when processing such CVSSv4 vectors.

Some examples:
https://api.osv.dev/v1/vulns/GHSA-g357-x5c3-c72p
https://api.osv.dev/v1/vulns/GHSA-9p7c-v5x3-rfx8
https://api.osv.dev/v1/vulns/GHSA-78fc-9688-w8xw

**To Reproduce**
Steps to reproduce the behaviour:
1. Go to any of the above links
2. Copy the CVSSv4 vector
3. Pass it to any schema-compliant CVSS parsing library
4. Library will raise an error

**Expected behaviour**
Error is not raised, CVSSv4 vector complies with the schema.

**Screenshots**
N/A

**Additional context**
N/A

Contributor guide

Open the contributing guide

Research direction

Start with the API responses for GHSA-g357-x5c3-c72p, GHSA-9p7c-v5x3-rfx8, and GHSA-78fc-9688-w8xw, then trace where their CVSSv4 vectors are stored or serialized. Compare the vectors with the CVSSv4 schema and verify them with a schema-compliant parsing library. Done means the affected API responses contain syntactically valid vectors without the trailing slash.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.